Cloud Security Operations, Monitoring and Incident Response
This domain tests detection, evidence handling, and response in environments where hosts are disposable and the control plane is itself a target.
What to log and where
Collect control-plane audit logs (who changed IAM, security groups, keys), data-plane access logs, VPC flow logs, DNS logs, WAF and load-balancer logs, and application logs. Centralize them in an account or subscription the compromised workload cannot write to or delete from. Retention must satisfy legal and investigative needs. Detection engineering baselines normal behaviour and alerts on deviations: new access keys, disabled logging, activity in unusual regions, mass object downloads. Tune alerts to reduce fatigue - an unactioned alert is not a control.
Response in cloud
Follow the NIST SP 800-61 lifecycle: preparation; detection and analysis; containment, eradication, and recovery; post-incident activity. Cloud-specific discipline: snapshot volumes and export logs before terminating anything, record instance metadata and API call history, isolate by swapping security groups rather than powering off, revoke and rotate credentials, and rebuild the timeline from audit logs.
Worked example
An access key appears in a public repository. The analyst disables the key first as containment, then queries audit logs for every action taken by that principal, checks for new IAM users, policies, or trust relationships, snapshots affected instances, rotates related secrets, and finally adds an organization-level policy denying key creation for that team. Reasoning: containment precedes investigation only because the credential is live; evidence capture runs in parallel, and the post-incident control removes the root cause.
Traps
Terminating the instance before snapshotting. Assuming the provider's incident response team handles your incident. Reviewing only data-plane logs and missing attacker actions in the control plane. Ignoring log integrity and clock synchronization when building a timeline.