CLOUD INCIDENT READINESS: CRITICAL INFRASTRUCTURE FOR CLOUD INCIDENT RESPONSE

Summary from the TLDR InfoSec newsletter

On Azure, security teams can utilize log analytics and storage accounts to analyze logs and subscription groups and Entra ID for containment and conditional access. In AWS, CloudTrail and Athena can be used for log analysis, and separate accounts with cross-org access can be used for containment and conditional access. In GCP, logs explorer can be used for log analysis.