Upon noticing a high-volume, unusual download event from a cloud storage bucket, which action should you take first?

• A. Run a SOAR playbook to suspend the user's bucket access and review timeline.
• B. Enrich the bucket entity with sensitivity labels and ACL data.
• C. Create a default detection rule to monitor future high-volume downloads; add user to high-risk watchlist.
• D. Review the user's timeline in SecOps focusing on network events and resource access before the anomaly.

Answer: (D)

When you spot a high-volume, unusual download from a cloud storage bucket, the first move is to review the user’s activity timeline leading up to the event. This immediate step provides essential context to distinguish between legitimate activity and potential compromise. By examining prior network connections, access patterns to resources, times of access, and data transfer volumes just before the anomaly, you can see if the spike fits normal work, or if there are red flags such as logins from unusual locations, rapid access to multiple sensitive buckets, or a shift in data transfer behavior.

This context helps you determine the appropriate next steps: you’ll know whether to escalate containment, refine monitoring, or verify business processes before taking action. Jumping to actions like suspending access or enforcing new rules without this context can disrupt legitimate activity or miss the true cause. Enriching metadata or creating detection rules are valuable, but they’re more effective after you’ve understood what happened from the user’s timeline.

So, starting with a timeline review centers you in on what happened before the anomaly, informing a measured, evidence-based response.