Which log source should be prioritized to gain visibility into user identity behavior, lateral movement, and privilege escalation in a cloud-heavy SecOps onboarding?

• A. EDR logs
• B. CASB logs
• C. IAM logs
• D. Network firewall logs

Answer: (A)

Endpoint activity telemetry is where you get the most direct signals of user behavior and post-auth actions, which is crucial for spotting lateral movement and privilege escalation. EDR logs capture detailed on-device activity: the processes that run, commands issued, files and registry changes, and which accounts or tokens are used. They also link these actions to specific endpoints and users, and often include related network connections that reveal how an attacker moves from one machine to another or attempts to elevate privileges on a host. Because cloud-heavy environments rely on people authenticating to systems and then interacting with workloads across devices, having rich endpoint visibility allows you to see the sequence of events that indicate suspicious identity-driven activity, such as unusual process hierarchies, credential dumping attempts, or remote execution attempts, all mapped back to the user account involved.

IAM logs are essential for understanding authentication events and privilege changes, but they don’t show what happens after a login on each device or how an attacker moves laterally across endpoints. CASB logs help with visibility into cloud app usage and data access, which is important for cloud data security but don’t provide the granular endpoint context needed to trace behavior across machines. Network firewall logs reveal traffic patterns but often lack the necessary endpoint-level context and user identity linkage to interpret who did what on which device.

So, focusing on EDR logs gives the richest, most actionable view of user identity behavior as it unfolds on endpoints, plus the direct signals of lateral movement and privilege escalation across a cloud-rich environment.