Evidence search
Search
Search titles, summaries, topics, providers, authors, and the full open-access corpus.
Results for “Evidence”
67 publicationsInvestigate an Entra application through grants and sign-ins
A successful service-principal sign-in is one event in a larger sequence. Connect it to credential changes, permission grants and the resource involved.
Detection & response · Microsoft Entra · By Cloud Security DeskDefine the expiry boundary for Entra privileged access
PIM records activation and expiry, but the protected application still determines when changed authority takes effect. Review both sides of that boundary.
Identity & access · Microsoft Entra · By Cloud Security DeskMeasure recovery by the service you can restore
Define application acceptance, recoverable data, and a complete timeline before treating a completed restore job as proof of recovery.
Resilience · AWS / PostgreSQL · By Cloud Security DeskKeep MCP tokens bound to the intended resource
Keep token audiences, user consent, and downstream tool authority separate when reviewing a protected HTTP MCP service.
AI systems · MCP · By Cloud Security DeskTest Kubernetes egress policies beyond a successful DNS lookup
Separate DNS resolution, source egress, destination ingress, and application identity when testing Kubernetes network isolation.
Workload security · Kubernetes / Cilium · By Cloud Security DeskVerify the CloudTrail files behind an incident timeline
Digest delivery and successful validation are different evidence states. Preserve the files, metadata and validation result needed to distinguish them.
Detection & response · AWS · By Cloud Security DeskClose the AWS sessions that survive identity shutdown
Removing a login does not by itself establish that issued AWS credentials have lost their authority. Build a revocation procedure that accounts for both.
Identity & access · AWS · By Cloud Security DeskProtect backup copies from the account that runs production
Map deletion authority, retention protection, keys, and recovery identities so a surviving backup has a usable path back to service.
Resilience · AWS · By Cloud Security DeskKeep private documents out of shared RAG answers
Authorize retrieved documents before they enter model context, preserve permissions on chunks, and make source access changes visible in the retrieval path.
AI systems · Azure · By Cloud Security DeskRoll out Kubernetes Pod Security Admission without surprises
Stage namespace enforcement around the Pods a controller will create next, with explicit policy versions, runtime checks, and narrowly owned exceptions.
Workload security · Kubernetes · By Cloud Security DeskChoose the S3 object events your investigation will need
CloudTrail event history is not an object-access ledger. Build selectors around the questions an investigation must answer, then test the exclusions.
Detection & response · AWS · By Cloud Security DeskLock GitHub deployment trust to the job you intend
A short-lived token still needs a narrow trust decision. Review the subject, deployment environment, reusable workflow and AWS role together.
Identity & access · AWS / GitHub · By Cloud Security DeskQwen3.8-Flash-Next and GLM-5.3-Flash share a 3:1 long-context pattern
Both models replace most conventional attention layers with recurrent state and reserve sparse attention for periodic retrieval. Their differences lie in where they place capacity, how much neural computation they activate, and what their serving stacks must keep trustworthy.
AI systems · Resilience · By Umair Akbar and Ahmed ElshekhThe permission path you didn’t review
Cross-account trust rarely fails at the obvious policy. The risk lives in the path between identities, conditions, and inherited access.
Identity & access · AWS · By Umair Akbar and Ahmed ElshekhCloud logs that never reach the SIEM
A dashboard can be healthy while the evidence behind it is incomplete. Coverage needs to be tested from event creation to searchable record.
Detection & response · AWS / Azure / Google Cloud · By Umair Akbar and Ahmed ElshekhWhat changes when static keys disappear
Workload identity removes a secret, but it also moves trust into issuers, claims, audiences, and runtime attachment points.
Identity & access · Workload security · AWS / Azure / Google Cloud · By Umair Akbar and Ahmed ElshekhFive Kubernetes events your cloud trail will not explain
Cloud control-plane logs tell you who changed the cluster. They do not fully explain what happened inside it.
Detection & response · Workload security · Kubernetes · By Umair Akbar and Ahmed ElshekhThreat-model the system around the model
The model endpoint is one component. The consequential paths often run through retrieval stores, orchestration identities, evaluation data, and operator tools.
AI systems · AWS / Azure / Google Cloud · By Umair Akbar and Ahmed ElshekhRecover the control plane before you need it
A recovery plan that depends on the compromised identity system is an aspiration. Build and test an independent administrative path.
Resilience · Identity & access · AWS / Azure / Google Cloud · By Umair Akbar and Ahmed Elshekh