Lesson 15 — Investigating Cloud Security Incidents
Cloud investigations combine active threat alerts with posture findings, identities, permissions, resources, attack paths and sensitive-data exposure.
Security Copilot in Microsoft Defender for Cloud can explain and summarise recommendations, support remediation and help analysts understand why a resource is at risk.
This lesson explains how to distinguish exposure from exploitation, validate multicloud evidence and move from a cloud alert to approved remediation and residual-risk reporting.
What you will learn
This lesson develops a complete Defender for Cloud investigation and remediation workflow.
Cloud-security investigation workflow
↓
Confirm tenant, subscription, cloud provider and resource ID
↓
Generate the Copilot summary
↓
Separate active alert evidence from posture findings
↓
Review affected resources, identities, permissions and network exposure
↓
Inspect recommendations, vulnerabilities, secrets and attack paths
↓
Correlate Defender XDR, Sentinel, Entra and workload evidence
↓
Build a cloud-resource timeline
↓
Separate confirmed exploitation, likely risk and legitimate administration
↓
Preserve evidence and apply approved remediation
↓
Monitor recurrence and document residual risk
Cloud evidence domains
| Domain | Evidence | Investigation question |
|---|---|---|
| Alert evidence | Threat activity, affected resources, timestamps, entities and recommended actions. | What activity was actually detected? |
| Posture evidence | Recommendations, vulnerabilities, misconfigurations, secrets and Secure Score. | Why was the resource exposed? |
| Attack path | Entry point, permissions, reachable resources and critical targets. | How could an attacker move through the environment? |
| Resource context | Subscription, owner, workload, provider, region and business criticality. | What is affected and how important is it? |
| Identity and network | Roles, managed identities, public exposure, firewalls and access paths. | Who or what could reach the resource? |
| Response | Remediation, delegation, code changes, containment and monitoring. | What was fixed and what risk remains? |
Learning objectives
- Investigate Defender for Cloud alerts.
- Distinguish alerts from recommendations.
- Analyse resources and attack paths.
- Review identity, network and sensitive-data context.
- Investigate Azure, AWS, GCP and hybrid workloads.
- Validate Copilot remediation guidance.
- Document residual cloud risk.
Start with the cloud alert
Open the Defender for Cloud alert and confirm its description, severity, affected resources, detection source and recommended actions.
Confirm the resource
Verify subscription, resource group, resource ID, region, cloud provider, workload type, owner and business purpose.
Alerts versus recommendations
Alerts describe detected threat activity, while recommendations describe posture weaknesses, vulnerabilities or exposed secrets.
Exposure is not exploitation
A vulnerable or internet-exposed resource may be at risk without evidence that an attacker used the weakness.
Use Security Copilot in Defender for Cloud
The embedded Copilot experience can analyse, summarise, remediate and delegate recommendations using natural-language prompts.
Summarise recommendations
Use Copilot to explain the recommendation, affected resources, underlying risk and likely remediation path.
Review effective risk
Defender for Cloud prioritises recommendations using current risk context such as exposure, resource criticality and attack paths.
Review cloud secure score
Secure Score helps measure posture improvement but does not represent active compromise.
Review attack paths
Attack path analysis visualises exploitable routes through vulnerabilities, permissions, exposure and high-value targets.
Attack path begins with possibility
An attack path identifies a potential route an attacker could use; it does not prove the route was taken.
Confirm the entry point
Review internet exposure, identities, endpoints, APIs, secrets and public services that form the beginning of the path.
Confirm the target
Identify whether the path reaches a critical database, storage account, key vault, workload or sensitive-data resource.
Review identities and permissions
Check owners, contributors, managed identities, service principals, keys and cross-resource permissions.
Review exposed secrets
Look for credentials, tokens, keys and secrets found in code, deployment artefacts or resources.
Review sensitive data
Use data-aware posture and attack paths to understand whether exposed resources contain sensitive information.
Review vulnerabilities
Confirm software, package, image and operating-system vulnerabilities associated with the affected workload.
Review misconfigurations
Check public access, weak encryption, missing MFA, network exposure, permissive rules and insecure defaults.
Review network exposure
Validate public IPs, NSGs, firewalls, load balancers, endpoints, peering and route context.
Review workload context
Understand whether the resource is a VM, container, Kubernetes cluster, serverless workload, database, storage service or application.
Review asset inventory
Use Defender for Cloud inventory to understand resource ownership, cloud location, active alerts and recommendations.
Review multicloud context
Confirm whether the affected resource belongs to Azure, AWS, GCP or a connected hybrid environment.
Review resource criticality
Business-critical resources require faster escalation and stronger change control.
Review alert evidence
Inspect timestamps, entities, activity, command details, network indicators and detection logic.
Review alert history
Determine whether similar alerts occurred previously on the resource or related workloads.
Review Defender XDR correlation
Check whether the cloud alert is part of a broader incident involving identities, endpoints, email or SaaS activity.
Review Sentinel correlation
Use Sentinel to connect cloud alerts with logs from identity, network, application and partner sources.
Review Entra activity
Check suspicious sign-ins, workload identities, role changes, consent and token use linked to the resource.
Review endpoint evidence
For servers and workloads with Defender for Endpoint integration, correlate processes, files and network activity.
Review container evidence
Inspect image vulnerabilities, runtime alerts, cluster configuration, identities and exposed services.
Review Kubernetes context
Check cluster role bindings, service accounts, public API exposure, admission controls and workload identities.
Review storage activity
Validate access keys, SAS tokens, public access, unusual downloads and sensitive-data exposure.
Review key vault activity
Inspect access policies, RBAC, secret retrieval, network controls and unusual identity use.
Review database activity
Check authentication, firewall rules, vulnerability findings, queries and sensitive-data access.
Review serverless workloads
Confirm discovery, inventory, misconfiguration, vulnerability and attack-path context for supported serverless containers.
Use Cloud Security Explorer
Build graph-based queries to find resources that match combinations of exposure, permissions, vulnerabilities and business context.
Use templates carefully
Prebuilt Cloud Security Explorer queries accelerate analysis but still require scope and result validation.
Use Azure Resource Graph
Query posture and recommendation data at scale across subscriptions when deeper filtering is needed.
Normalise cloud identifiers
Use immutable resource IDs rather than names alone when correlating resources.
Build the resource timeline
Combine deployment, configuration, alert, identity and response events in one time zone.
Check change history
Review recent deployments, policy changes, role assignments and network modifications.
Check legitimate administration
Approved deployment, scanning, maintenance and testing can resemble suspicious cloud activity.
Ask for alternative explanations
Prompt Copilot to compare malicious exploitation with misconfiguration, expected scanning and administrative change.
Ask what is confirmed
Require Copilot to separate observed attacker activity from posture risk and inferred attack paths.
Ask for missing visibility
Identify unavailable subscriptions, logs, agents, plans, connectors or permissions.
Validate remediation guidance
Review generated steps against platform documentation, architecture, dependencies and change control.
Remediate code carefully
Copilot can assist with code remediation, but generated changes must be reviewed, tested and approved.
Delegate recommendations
Recommendation delegation supports ownership, due dates and governance but does not complete the technical fix.
Use governance rules
Assign recommendation owners, due dates and accountability for cloud posture improvement.
Preserve cloud evidence
Capture alerts, activity logs, sign-ins, resource configuration and relevant snapshots before destructive changes.
Contain identities
Disable or restrict compromised identities, revoke sessions and remove excessive permissions when supported by evidence.
Contain network access
Use NSGs, firewalls, private endpoints or isolation steps according to architecture and approval.
Rotate secrets
Replace exposed keys, passwords, tokens and certificates and identify every dependent system.
Patch vulnerable workloads
Apply updates only after impact, compatibility and deployment planning are reviewed.
Remove persistence
Review identities, automation, role assignments, extensions, startup commands and deployment mechanisms.
Review response completion
Confirm remediation, delegation and policy changes actually completed and did not fail.
Monitor for recurrence
Watch for repeated alerts, new identities, reintroduced exposure, failed fixes and continued data access.
Document residual risk
Record weaknesses that remain, compensating controls and planned remediation dates.
Separate incident closure from posture closure
The active incident can be contained while underlying recommendations and attack paths remain unresolved.
Final analyst validation
The analyst approves the cloud attack story, scope, remediation and residual risk after reviewing original evidence.
Example cloud-investigation prompt
Include:
1. Cloud provider, subscription, resource group and immutable resource ID
2. Resource owner, workload purpose and business criticality
3. The detected activity and supporting alert evidence
4. Relevant recommendations, vulnerabilities, misconfigurations and exposed secrets
5. Related attack paths and sensitive-data exposure
6. Identity, permission and network relationships
7. Related Defender XDR, Sentinel and Entra evidence
8. Confirmed exploitation, posture risk and legitimate alternatives
9. Recommended containment and remediation steps
10. Missing telemetry, residual risk and confidence level
Do not treat an attack path or recommendation as proof of exploitation.
Agent Foskett investigation: “The attack path existed before the attack…”
↓
Security Copilot linked the resource to an attack path ending at sensitive storage
↓
The first summary suggested lateral movement to the storage account
↓
Agent Foskett opened the alert evidence
↓
The suspicious process was confirmed on the virtual machine
↓
The attack path showed that the VM identity could reach the storage account
↓
But storage access logs showed no access from that identity
↓
The recommendation and path had existed for weeks
↓
No secret retrieval or data download occurred during the incident
↓
The VM was confirmed compromised
↓
The storage account was confirmed exposed through permissions
↓
Data compromise was not confirmed
↓
The VM was contained and rebuilt
↓
The identity permissions were reduced and the attack path removed
↓
The incident and posture issue were related
↓
But they were not the same conclusion
Cloud-investigation validation checklist
| Area | Question | Validation action |
|---|---|---|
| Resource | Is the correct resource and provider selected? | Confirm immutable ID and ownership. |
| Alert | What activity was actually detected? | Review original alert evidence. |
| Recommendation | What weakness or exposure exists? | Review affected resources and risk factors. |
| Attack path | Does the path show possibility or observed movement? | Separate graph reachability from activity logs. |
| Identity | Which user, role or managed identity had access? | Review RBAC and Entra evidence. |
| Network | Was the resource externally reachable? | Check public endpoints, rules and routes. |
| Data | Was sensitive data actually accessed? | Review storage, database and Purview logs. |
| Remediation | Are generated changes safe and approved? | Test code and follow change control. |
| Completion | Did the fix remove the exposure and stop activity? | Confirm alerts, recommendations and paths update. |
| Residual risk | What remains unresolved? | Document owners, due dates and controls. |
Key takeaways
- Defender for Cloud provides alerts, recommendations, asset inventory, attack paths and multicloud posture context.
- Security Copilot is embedded in Defender for Cloud to analyse, summarise, remediate and delegate recommendations.
- Alerts describe detected threat activity, while recommendations describe weaknesses or exposure.
- Attack paths identify potential exploitable routes and do not prove that an attacker used them.
- Cloud investigations should confirm resource identity, owner, provider, workload and business criticality.
- Identity, permissions, network exposure, secrets, vulnerabilities and sensitive data all affect cloud risk.
- Cloud Security Explorer and Azure Resource Graph support broader posture investigation.
- Generated remediation code and advice require testing, approval and change control.
- Incident containment and posture remediation can finish at different times.
- The analyst remains responsible for confirming exploitation, impact and residual risk.
What Agent Foskett checked
- Resource ID
- Alert evidence
- Attack path
- Managed identity
- Storage permissions
- Access logs
- Sensitive data
- Remediation status
- Residual exposure
- Final confidence
Best practices
- Confirm the resource.
- Separate alerts and posture.
- Review attack paths.
- Validate identity and network context.
- Check sensitive-data exposure.
- Correlate XDR and Sentinel evidence.
- Preserve cloud logs.
- Test remediation.
- Track ownership and due dates.
- Document residual risk.
Related Agent Foskett resources
Continue the Microsoft Security Copilot Academy
How do you investigate cloud security incidents with Microsoft Security Copilot?
Security Copilot in Microsoft Defender for Cloud can analyse, summarise, remediate and delegate cloud security recommendations using natural-language prompts.
Defender for Cloud attack-path investigation
Attack paths show potential exploitable routes through cloud resources, identities, permissions and vulnerabilities, while analysts validate whether any movement or exploitation actually occurred.
Cloud alerts and recommendations
Cloud alerts represent detected threat activity, while recommendations identify vulnerabilities, misconfigurations and exposed secrets that affect posture and residual risk.
