When a medium severity alert indicates unusual cloud storage access by a senior developer outside working hours, what should you do first?

• A. Run a SOAR playbook to suspend the user's bucket access and review timeline.
• B. Enrich the bucket entity with sensitivity labels and ACL data.
• C. Create a default detection rule to monitor future high-volume downloads; add user to high-risk watchlist.
• D. Review the user's timeline in SecOps focusing on network events and resource access before the anomaly.

Answer: (D)

Investigating the incident by reviewing the user’s activity timeline—specifically network events and resource access before the anomaly—is the best first move because it quickly establishes context for why the unusual access occurred. This helps determine whether the activity is legitimate (for example, an after-hours deployment or maintenance) or suspicious (such as a compromised credential or data exfiltration). Gaining this understanding before taking action prevents unnecessary disruption of legitimate work and informs the appropriate containment or remediation steps. Enriching bucket metadata, adding the user to a watchlist, or launching a containment playbook without this context can lead to wrong conclusions or premature actions. Start with a thorough timeline review to anchor the response in evidence and situational awareness.