Cloud detection and response (CDR) is the practice of watching cloud activity for signs of attack and responding quickly. It centers on control plane logs, identity activity and workload events rather than network perimeters. The test of any CDR approach is whether you can see, alert on and contain an attacker's actions in your cloud accounts.
Why is cloud different from a data center?
In a cloud account, the attacker's tools are API calls. Stealing a credential and creating a new access key, listing storage, or changing a security rule are normal operations that happen to be abused. MITRE's ATT&CK Cloud matrix reflects this: it covers four platforms, Office Suite, Identity Provider, SaaS and IaaS, and sets out 12 tactics, from Initial Access through Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection and Exfiltration to Impact. It also includes Stealth and Defense Impairment, which are about hiding and disabling detection.
The identity provider and the SaaS layer sit inside the matrix alongside infrastructure. Cloud detection is therefore not just about virtual machines. A stolen single sign-on session can matter more than any server.
What are the data sources?
NIST SP 800-53 gives the baseline logic. AU-2 Event Logging asks you to identify the types of events the system can log, choose which to log with a rationale showing they support after-the-fact investigation, and review the list. AU-3 says each record should establish what happened, when, where, the source, the outcome and the identity involved. SI-4 System Monitoring asks you to monitor to detect attacks and indicators of potential attacks and unauthorized connections.
In practice, that points to:
- Control plane audit logs from each cloud account: who called which API, from where.
- Identity provider logs: sign-ins, multi-factor prompts, new devices, role changes.
- SaaS audit logs: mailbox rules, file sharing, admin changes.
- Workload and container events, and network flow logs where available.
What should detections look for?
Map detections to the ATT&CK Cloud tactics. A few concrete signals:
- A new access key created for a long-dormant user (Persistence).
- A role gaining broader permissions outside a change window (Privilege Escalation).
- A burst of list and describe calls from a new address (Discovery).
- Logging turned off or retention shortened (Defense Impairment).
- Large reads from a storage bucket by an identity that never used it (Collection and Exfiltration).
The Defense Impairment tactic deserves its own alert. An attacker who disables logging is telling you what they plan to do next.
What does response mean in the cloud?
NIST SP 800-53 IR-4 describes an incident handling capability that includes preparation, detection and analysis, containment, eradication and recovery. In a cloud account, containment often means revoking sessions, disabling a key, attaching a deny policy, or isolating an instance, all done through the same APIs the attacker used.
A constructed example. An alert fires: a developer's access key lists all storage buckets from an unfamiliar country at 3 a.m. The responder disables that key, revokes active sessions for the user, snapshots the audit log for the preceding day, and checks whether any new keys or roles were created. A scheduled script rotates the credentials for anything the key could reach.
The speed matters because cloud actions are fast and often automated on the attacker's side.
How to check or apply this
- Confirm audit logging is on in every cloud account and region, and that logs go to a place the account's administrators cannot silently delete.
- Collect identity provider and key SaaS audit logs into the same place.
- List five ATT&CK Cloud techniques you most fear, and write a detection for each.
- Alert on any change to logging configuration.
- Document containment steps per cloud: revoke session, disable key, isolate workload.
- Test one scenario with a tabletop exercise or a controlled test in a sandbox account.
- Review retention against what investigations need, per AU-11 on audit record retention.
Quick check
Is CDR the same as a SIEM?
Not exactly. A SIEM is a place to collect and search logs. CDR describes the cloud-focused detection and response work, which may use a SIEM, native cloud services or other tools.
What is the first log to turn on?
The control plane audit log for each cloud account, since it records API activity. Add identity provider logs next.
Sources
- MITRE ATT&CK Cloud matrix
- NIST SP 800-53 Rev. 5 control catalog, OSCAL JSON from NIST (AU-2, AU-3, AU-11, SI-4, IR-4)
Last reviewed: 18 October 2026.
