Cloud Response and Analysis — GIAC Enterprise Incident Response

Official references for this objective

• Sans — FOR608: Enterprise-Class Incident Response & Threat Hunting | SANS Institute

  we look for suspicious user logon and email activity from the Unified Audit Logs (UAL) as a common method for detection