ArcanaIncident-response documentationBrowse the feedTemplates
Back to feed
Runbook · Analysis
RB-ANALYSIS-020

Cloud Storage & SaaS Review

1. Prerequisites

  • Suspected or confirmed data exfiltration incident
  • Access to cloud provider audit logs
  • Access to SaaS audit logs
  • Access to cloud storage activity logs
  • Access to Identity Provider (IdP) logs
  • Access to SIEM
  • Access to CASB tooling (if available)
  • User accounts, hostnames, and assets identified during triage
  • Investigation timeline established

2. Step-by-Step Instructions

  1. Identify Cloud and SaaS Services in Scope

    • Identify:
      • Cloud storage platforms
      • SaaS applications
      • Collaboration platforms
      • File sharing services
    • Document all platforms associated with the investigation.

  2. Review User Authentication Activity

    • Review:
      • Login events
      • Failed login attempts
      • MFA activity
      • Geographic anomalies
      • Impossible travel events
    • Identify suspicious authentication activity associated with affected users.

  3. Review File Upload Activity

    • Investigate:
      • Large file uploads
      • Bulk upload activity
      • Unusual upload patterns
      • Uploads outside business hours
    • Document all suspicious file transfer activity.

  4. Review File Download Activity

    • Identify:
      • Mass download activity
      • Unusual download locations
      • External access events
      • Bulk export activity
    • Determine whether data may have been collected for exfiltration.

  5. Review Sharing Activity

    • Investigate:
      • Public sharing links
      • Anonymous sharing
      • External user access
      • Guest account access
      • Shared folders and repositories
    • Identify potential exposure paths.

  6. Review Third-Party Application Access

    • Investigate:
      • OAuth applications
      • API integrations
      • Service accounts
      • Third-party connectors
    • Identify unauthorised or suspicious integrations.

  7. Review Administrative Activity

    • Review:
      • Permission changes
      • Role assignments
      • Configuration modifications
      • Sharing policy changes
    • Determine whether access controls were modified to facilitate data access or transfer.

  8. Correlate with Endpoint and Network Activity

    • Compare findings against:
      • Outbound Traffic Analysis
      • Data Staging Investigation
      • Authentication Log Analysis
    • Determine whether cloud or SaaS activity aligns with identified exfiltration behaviour.

  9. Determine Scope and Impact

    • Identify:
      • Affected users
      • Affected applications
      • Affected datasets
      • External recipients
      • Potentially exposed information
    • Document findings and confidence level.

  10. Escalate and Hand Off

    • Provide findings to the Incident Commander and Technical Lead.
    • Escalate to:
      • Sensitive Data Impact Assessment
      • Exfiltration Scoping Hunt
      • Containment activities
    • Update the incident record with all findings.

3. Post-Action

  • Ensure all affected cloud and SaaS platforms are documented.
  • Preserve relevant audit logs and artifacts.
  • Document all external sharing activity.
  • Document all identified third-party integrations.
  • Record all affected users, applications, and datasets.
  • Attach investigation findings to the incident record.
  • Participate in subsequent containment and impact assessment activities as required.

Contributor

Vishal Thakur
GitHub: https://github.com/malienist

Contributed to the Arcana Incident Response Documentation Framework.