Which cloud logs and services should you integrate?
Every provider separates two types of data: activity logs, which tell you who did what to which resource, and the findings from its security services, which already interpret that data. You want both.
| Provider | Activity logs | Detection and posture | Other useful sources |
|---|---|---|---|
| AWS | CloudTrail: API calls, including console sign-ins | GuardDuty, Security Hub, IAM Access Analyzer | VPC Flow Logs, Route 53 DNS query logs, S3 access logs |
| Microsoft Azure | Azure activity log and Microsoft Entra ID sign-in logs | Microsoft Defender for Cloud | Network flow logs, Key Vault and Storage diagnostic logs |
| Google Cloud | Cloud Audit Logs: Admin Activity and Data Access | Security Command Center | VPC Flow Logs, Cloud DNS logs |
One detail that is often overlooked: data access logs, such as object reads in S3 or Cloud Storage, are usually not enabled by default. They are the ones that tell you what an attacker took.
What attacks can be detected in the cloud?
According to Google's Cloud Threat Horizons Report (H1 2026), in the incidents Google observed in its cloud during the second half of 2025, exploitation of vulnerabilities in third-party software was the most common initial access vector (44.5%), followed by weak or missing credentials (27.2%) and misconfigurations (21%). With the right logs, you can detect:
- Use of leaked keys: API calls from new IP addresses or regions using long-lived credentials that had gone unused for months.
- Privilege escalation: creation of users, keys or roles with administrator permissions, or changes to IAM policies.
- Covering tracks: disabling CloudTrail, deleting logs, or turning off GuardDuty or Defender for Cloud.
- Data exposure: a storage bucket or container that becomes public, or a disk snapshot shared with another account.
- Resource abuse: GPU instances launched in regions you don't use, typical of cryptocurrency mining.
- Compromised workloads: an exposed virtual machine or container that starts connecting to malicious infrastructure.
What is the difference between CSPM and cloud threat detection?
CSPM (Cloud Security Posture Management) reviews configuration: public buckets, ports open to the internet, accounts without MFA or encryption turned off. It answers the question of what could go wrong. Threat detection analyzes activity in near real time and answers what is happening right now. Defender for Cloud, Security Command Center, Wiz and Orca combine both functions to different degrees. In a SOC, posture helps you prioritize (an alert on a public resource holding sensitive data carries more weight) and detection tells you when to act.
What response actions can be taken in the cloud?
| Situation | Common action | Caution |
|---|---|---|
| Compromised access key | Deactivate the access key, revoke the temporary sessions issued with it and create new credentials for legitimate use. | Deactivate before deleting, so you can roll back if it breaks an application. |
| Compromised instance | Isolate it with a security group that only allows traffic from the investigation team, and take a snapshot of the disk. | According to AWS, changing the security group does not cut connections that are already tracked, only new traffic; to cut those, AWS points to network ACLs. Do not terminate the instance before capturing evidence. |
| Exposed storage | Block public access and review the data access logs. | If those logs were not enabled, you won't know what was taken. |
| Privileges added to a user or role | Remove the new permissions and review what was done with them. | Check whether the change came from a legitimate deployment. |
| Logging disabled | Turn it back on and treat it as an incident until it is explained. | Turning off logging is often one of the first things an attacker does. |
How does it differ from other integrations?
In the cloud, identity and infrastructure blend together: an IAM permission is both an account and the key to a server. That's why these integrations are correlated mainly with identity (who signed in and with which method) and with network (where workloads connect to). Microsoft 365 and Google Workspace accounts are covered in the identity integration; here we focus on infrastructure: machines, containers, storage and managed services.
How Ciberia helps
Ciberia MDR integrates with AWS, Azure and Google Cloud and their security services, and its AI agents correlate their findings with identity, endpoint and network. Ciberia CTM monitors your external exposure, such as internet-facing infrastructure or leaked credentials, before someone exploits it. When action is needed, the AI proposes the response, an analyst validates decisions with impact, and the action is orchestrated according to the provider, for example disabling credentials or isolating an instance, with every step logged. The AI is proprietary and data is processed on servers located in Spain.
