Cloud and SaaS log forensics
When a mailbox rule forwards invoices to a stranger or an access key is used from a new country, the proof sits in the cloud provider's logs. Those logs have limits: some are kept for a short time, some are off by default and some need a specific license to show the detail you need.
What we do
- Logging readiness check
- Audit log collection
- Sign-in timeline building
- Mailbox compromise review
- Cloud API activity review
- Retention gap reporting
- Evidence handling
Our team works with the Microsoft Purview audit log, Microsoft Entra sign-in logs, AWS CloudTrail and the Google Workspace audit log, and has experience with the Microsoft Extractor Suite for collection. We check what is turned on before an incident, export records to storage you control and build a timeline of sign-ins, mailbox changes, file access and token use.
This group links to our Cybersecurity practice and to the forensics and Microsoft 365 groups. Logs show what the platform recorded, not everything that happened, so we state those gaps in every report. These are tools our team has experience with, not partnerships.
Leading platforms we work with
- Microsoft Purview Audit
- Microsoft Entra sign-in logs
- AWS CloudTrail
- Google Workspace audit log
- Microsoft Extractor Suite
- Splunk
Platforms and practices
- Audit logging status check before an incident
- Unified audit log search and export
- Sign-in and token activity timelines
- Mailbox rule and forwarding review
- OAuth app consent review
- CloudTrail event history and trail review
- Google Workspace admin and Drive activity logs
- Log retention gaps and licensing limits
- Evidence export with hash records
References
- Microsoft Purview auditing solutions
- Microsoft Entra sign-in logs
- AWS CloudTrail user guide
- Google Workspace audit logs
- Microsoft Extractor Suite
Sources last checked .
Product names are trademarks of their owners and are listed to describe our experience; they do not imply endorsement or partnership.
How we use Cloud and SaaS log forensics for clients
Cybersecurity
We find out whether everything you run is safe from attackers, then we fix it.
Learn moreCloud Management
Cloud cost review and management, without compromising on quality or security.
Learn moreManaged IT Services
We run your IT day to day so it stays secure: help desk, devices, Microsoft 365, Exchange, Active Directory, backups, networks and monitoring.
Learn moreFrequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageHow long do cloud audit logs last?
It depends on the service, the license and the settings, and some logs are off until someone turns them on. That is why we check logging status before an incident and export records to storage you control. Retention limits are listed in each provider's own documentation, so confirm yours.
Can logs prove exactly what an attacker did?
Not always. Logs show what the platform recorded, and some actions are never recorded or are kept only for a short time. Our reports state those gaps instead of filling them with guesses.
What should we turn on before something happens?
Confirm that audit logging is enabled in each cloud service you use, that the license you hold gives the detail you need, and that records are copied somewhere you control. A readiness check lists what is on, what is off and what is missing.
Do you need admin access to our accounts to review logs?
Collection usually needs a read-only account with the audit permissions the provider requires. We agree the access and scope in writing first, and we ask you to remove the account when the work ends.