Clue: Incident Response (SOC Edition)

A security incident has been detected! Work with your IR team to determine the attack vector, compromised resource, and affected cloud region. Interview suspects, analyze evidence, and review logs to solve the case before the attackers cover their tracks! 

Suspects:
• Colonel Key Leak (The Careless Dev)
• Professor Privilege Escalation (The Insider)
• Mrs. Malicious Code (The Supply Chain)
• Rev. Root Access (The Admin)
• Miss Misconfiguration (The Automator)
• Dr. Data Breach (The Contractor)

Weapons (Attack Vectors):
• Leaked Credentials
• Supply Chain Compromise
• Misconfigured IAM Role
• Unpatched Vulnerability
• Exposed API Key
• Social Engineering Rooms (Cloud Locations):
• Production VPC
• Staging Environment
• CI/CD Pipeline
• Data Lake
• Identity Provider
• Container Registry