Skip to main content

Investigation: Cloud And Kubernetes Incident

Draft​

Level: Complex Platform Workflows

Goal: Investigate a cloud/Kubernetes incident using sector, TTP, IOC, and detection context.

Real-Life Scenario​

A Kubernetes workload starts beaconing externally after suspicious service account activity, and the team needs to combine cloud context, TTPs, IOCs, and telemetry requirements.

When To Use This​

Use this workflow when you need an end-to-end platform workflow across multiple AdversaryGraph modules and want the output to remain traceable to evidence.

Steps​

  1. Create workspace and select cloud/Kubernetes technology context.
  2. Import incident notes, audit logs summary, or report text.
  3. Run AI extraction and manually validate cloud-relevant TTPs.
  4. Use Sector Intel filters for cloud/Kubernetes-related actor relevance.
  5. Extract service accounts, domains, IPs, tools, and hashes as IOCs/artifacts.
  6. Enrich observables and identify malware/tool families where possible.
  7. Compare TTPs to actor and campaign profiles.
  8. Review ATT&CK matrix for cloud-adjacent execution, persistence, discovery, credential access, and exfiltration.
  9. Map each accepted TTP to available telemetry such as Kubernetes audit, cloud control plane, EDR, or proxy logs.
  10. Export a PDF and a detection backlog for the cloud/SOC team.

Expected Result​

Cloud incident CTI package with prioritized telemetry-backed detection work.

Review Notes​

  • Keep source labels and evidence attached to every accepted result.
  • Treat actor matches, enrichment hits, and matrix overlap as analytical signals until corroborated.
  • Export only reviewed findings for customer, SOC, detection engineering, or executive use.

Platform Areas Used​

  • Operations / Pipeline
  • AI Analysis
  • ATT&CK Group Library
  • IOC Library
  • VirusTotal / OTX / ThreatFox / Malpedia enrichment where configured
  • Reference Sync
  • Navigator matrix
  • PDF, JSON, CSV, STIX, and Navigator exports as needed