Seceon Cloud Forensics turns control-plane, identity, network, workload and storage evidence into one searchable investigation across AWS, Azure, GCP, VMware, Nutanix, OpenStack and Hyper-V — public, private and hybrid.
Cloud evidence is scattered and short-lived. Seceon OTM collects it continuously, correlates it once, and keeps it long enough to investigate when detection comes late.
Public cloud, private cloud and hybrid estates in the same schema and case.
API connectors, log streams, object-store buckets and agents into one pipeline.
Raw and normalised evidence under your policy when provider defaults have rolled off.
The problems below are cloud-forensics problems. None of them is fixed by asking the provider for a one-off export after the fact.
Why cloud evidence is hard
Preserve early, correlate across domains
Every cloud investigation rides the same OTM pipeline: CCE, APE and LTS.
API connectors, log-streaming pipelines, object-store buckets and agent or syslog forwarders across accounts, subscriptions and clusters.
CCE parses and enriches events into one evidence model so hybrid cases share fields, not spreadsheets.
APE applies AI/ML, UEBA, threat intelligence and MITRE ATT&CK-mapped policies for prioritised leads.
LTS keeps raw and normalised evidence under your retention policy for look-back and audit.
Search, timeline reconstruction, IOC/IOA hunting and case management across public and private sources.
Integrity hashing, custody records and investigation packages suitable for management, audit and legal audiences.
Both domains matter — and hybrid incidents need both at once.
Control-plane audit (CloudTrail, Azure Activity Log, Cloud Audit Logs), identity and key usage, VPC/VNet flow and DNS, workload OS and Kubernetes audit, storage access and SaaS trails — including OCI and IBM Cloud on the same pattern.
Management plane (vCenter, Prism, OpenStack, SCVMM), hypervisor host access, virtual network and east-west flows, and guest workload telemetry via agents or EDR — so you see who created the VM and what then ran inside it.
Collect at the top of each hierarchy — organization trail, tenant-wide diagnostics, vCenter syslog or Prism Central — so new accounts and clusters are covered automatically.
The cases cloud security teams meet most often.
Tie sign-in and STS/IAM events to API calls, regions and resources touched.
Correlate config and audit events with subsequent data access and exfiltration paths.
Ingest cluster audit and runtime events; attribute actions to the creating identity.
One timeline from a private-cloud VM or jump host into a public-cloud tenant.
Storage and SaaS access logs with identity context and after-hours patterns.
LTS retention when default provider logs have already aged out.
The same platform, tuned to how each team consumes cloud evidence.
Related Seceon forensics datasheets and the OTM platform.
Public: AWS, Microsoft Azure, Google Cloud, Oracle Cloud Infrastructure and IBM Cloud. Private: VMware, Nutanix, OpenStack and Microsoft Hyper-V, plus containers, identity providers and SaaS — including hybrid and air-gapped estates.
Traditional forensics seizes disks and memory. Cloud forensics works through provider APIs, audit logs, flows, snapshots and management-plane records. Seceon keeps both in one investigation model when an incident crosses environments.
Evidence exists only for sources onboarded before or during the incident, and only for the LTS retention configured. Collection at the top of each cloud hierarchy is recommended so new accounts and clusters are covered automatically.
Yes. OTM supports on-premises, sovereign and air-gapped deployments. Air-gapped environments are planned with each customer because transfer processes and security rules differ.
