Security Operations & Threat Intelligence

A newly created public bucket may be an intentional website asset location or an accidental exposure of internal data. Storage permissions can be inherited or changed by policy after creation. What to check Confirm bucket owner, creation event, public access path, object inventory, data classification, access logs, and deployment purpose. Review...

A new service account may support an approved integration or create persistent access that is difficult to attribute. Its permissions and secret custody can be broader than the immediate task requires. What to check Review creator, owner, purpose, permissions, authentication method, secret storage, last use, and approval record. Compare activity with...

A login from a new device can indicate legitimate travel or a new laptop, but it can also reflect stolen credentials or a session token. Device novelty alone is not enough to determine whether access is authorized. What to check Confirm the user through an independent contact path, review authentication method, device registration, location and time...

A new administrator API key may be part of deployment automation or an unauthorized persistent credential. API keys can be used without interactive sign-in and may not appear in normal user login reports. What to check Identify who created it, its owner, scope, expiration, storage location, last use, and associated deployment. Review audit events and...

An unexpected password reset can be a legitimate recovery action, a user mistake, or an attempt to take over an account. A reset notification alone does not show who requested it or whether access changed. What to check Review reset event source, authentication context, verification method, subsequent sign-ins, recovery contact changes, and account...

A mailbox delegation can provide legitimate coverage or enable someone to read and send messages without using the mailbox owner’s password. Unexpected delegation may expose sensitive communications. What to check Check who granted access, delegate identity and permissions, approval, creation time, subsequent mailbox activity, and related sign-ins....

MFA may be disabled for a legitimate recovery, temporary exception, or attacker attempting to weaken account protection. The alert needs context about who made the change and what happened to the account afterward. What to check Review actor, approval, time, affected account, authentication method, sign-ins before and after, session changes, and...

A newly created external sharing link may be an approved collaboration or an unintended exposure of internal files. Link-based access can persist even if the original recipient changes. What to check Identify file owner and classification, link scope, expiration and download settings, creator, recipients, access logs, and business purpose. Check...