Design 05 - Cross-Cloud Incident Response Platform

Prompt

Design the operating model and technical platform for incident response across AWS, Azure, Google Cloud, Kubernetes, SaaS identity, Windows, Linux, and macOS endpoints.

Architecture

  • Organization-level log collection into a dedicated security account/project with separate admin.
  • Standard event envelope preserving original event, source, tenant/account, identity, asset, event/ingest time, schema version, and integrity metadata.
  • Asset/identity inventory and ownership graph.
  • Detection-as-code repository with fixtures, review, deployment, health, and rollback.
  • Case system links hypotheses, queries, evidence manifests, actions, decisions, and status updates.
  • Read-only investigation roles separate from approved containment roles.
  • Forensic collection packages are platform-specific, signed, privacy-scoped, and auditable.

Design Risks

Compromised source suppresses logs, centralized collector becomes high-value target, schema drift breaks detections, ingestion delay distorts timeline, responders gain excessive privilege, containment destroys evidence or service, and data retention violates privacy/residency.

Validation

  • Known event generated and located from every source.
  • Heartbeats detect disabled or delayed telemetry.
  • Timeline tests include clock drift, duplicate, late, and missing events.
  • Detection fixtures run in CI and production canary.
  • Break-glass and containment actions require reason, approval where possible, and expiry.
  • Quarterly restore, credential compromise, collector failure, and executive tabletop.

Incident Workflow

Declare roles and severity; preserve volatile evidence; list facts/hypotheses; scope identities, assets, network, cloud control plane, data, and persistence; choose reversible containment; rotate and rebuild; recover with heightened monitoring; review system causes and control health.

Executive Interface

Dashboards show material incidents, time to detect/contain/recover, control/data health, affected business services, aging corrective actions, and uncertainty. Raw alert count is an operational input, not an executive outcome.