Skip to content
Cloud Security DeskSearch
Menu

Evidence search

Search

Search titles, summaries, topics, providers, authors, and the full open-access corpus.

Results for “Incident evidence”

15 publications
Technical guideSource-based analysis

A defensible cloud patch queue starts with exploitation evidence

Join exploitation evidence to affected assets, exposure, ownership and verified remediation without turning CVSS, EPSS or a catalog entry into a complete risk score.

Detection & response · CISA / NIST / FIRST · By Cloud Security Desk
Technical guideSource-based analysis

Security evidence for AI release decisions

A release approval should identify the changed application, the claims its tests support and the evidence that expires when a model, prompt, data path or runtime changes.

AI systems · By Cloud Security Desk
Technical guideSource-based analysis

Recovery objectives that match the cloud service

Define the business function, outage clock, recoverable data and dependency assumptions before choosing a cloud disaster-recovery architecture.

Resilience · AWS / Azure / Google Cloud / NIST · By Cloud Security Desk
Technical guideSource-based analysis

What cloud snapshots cannot preserve

Separate live execution, persisted disk and provider records before an authorized containment decision destroys evidence that a snapshot cannot recover.

Detection & response · AWS / NIST · By Cloud Security Desk
Technical guideSource-based analysis

A controlled return from the SQS dead letter queue

Repair the failure, check consumer compatibility and return failed work with a bounded rate, observable stop conditions and business reconciliation.

Resilience · AWS · By Cloud Security Desk
Technical guideSource-based analysis

Testing Sigma detections before a backend change

Keep rule structure, field transformations, query conversion and event matching as separate checks when changing a Sigma detection backend.

Detection & response · SigmaHQ · By Cloud Security Desk
Technical guideSource-based analysis

Error budgets for controlled service degradation

Protect essential work under load while counting rejected and degraded requests against the service promise that users were actually given.

Resilience · Google / Envoy · By Cloud Security Desk
Technical guideSource-based analysis

Cloud incident severity needs a service impact model

Connect incident priority to service consequences, scope and time criticality while preserving evidence confidence and the authority to revise the decision.

Detection & response · NIST / FIRST · By Cloud Security Desk
Technical guideSource-based analysis

A budget model for bounded AI inference

Request throttles, token quotas and billing alerts control different things. An inference service needs an admission decision that reserves bounded work and reconciles what actually ran.

AI systems · AWS / Kubernetes / vLLM · By Cloud Security Desk
Technical guideSource-based analysis

Certificate renewal under shorter validity limits

Use the public TLS issuance schedule to review authorization, renewal, deployment and independent verification of the certificate an endpoint actually serves.

Resilience · CA/Browser Forum / Let's Encrypt / AWS · By Cloud Security Desk
Technical guideSource-based analysis

The telemetry collector is part of the evidence boundary

Review sender identity, tenant routing, processing and export as separate trust boundaries before treating collected telemetry as dependable evidence.

Detection & response · OpenTelemetry · By Cloud Security Desk
Technical guideSource-based analysis

An evidence plan for AI incident response

An AI incident record needs to connect the system version, context, output, downstream action and observed consequence. A saved prompt or a public report is only part of that evidence.

AI systems · By Cloud Security Desk
Technical guideSource-based analysis

The bottlenecks that shape a cloud DDoS response

Distinguish bandwidth, packet processing, connection state and application work before choosing a DDoS response or assuming the whole service path is protected.

Resilience · AWS / Azure / Google Cloud / Cloudflare · By Cloud Security Desk
Technical guideSource-based analysis

Cloud detection coverage after the ATT&CK data model change

Connect current ATT&CK strategies and analytics to available events, implemented rules and test evidence, while keeping taxonomy counts separate from protection.

Detection & response · MITRE · By Cloud Security Desk
Technical guideSource-based analysis

Where DNS failover loses control of the clock

Separate authoritative routing, resolver caches, stale answers, runtime caching and existing connections when describing what DNS failover can achieve.

Resilience · AWS / Cloudflare / Oracle · By Cloud Security Desk