← incident responder

Cloud IR — M365, AWS, and Azure Incident Response

advanced 5h

Investigate and contain cloud-native incidents — compromised M365 tenants, AWS credential abuse, Azure AD breaches — using cloud-native logging, forensic tooling, and containment primitives.

Lessons

1 M365 Incident Response — Unified Audit Log and Email Compromise
25 min
2 AWS CloudTrail Investigation — IAM Abuse, Credential Compromise, and Data Exfiltration
25 min
3 Azure AD / Entra ID Investigation — Conditional Access, Service Principals, and Tenant-Wide Scope
20 min

Module Quiz

Test your knowledge before moving on.

Take Quiz →