Forensics in the Clouds
Forensics is very well understood and practiced by CIRTs in on-prem environments but what happens when DFIR needs to be
Incident Response in Azure AD
I’m using this post as a notepad for the SANS Cyber Defense Summit talk based on Monitoring and Incident Response