SOP-44: Azure Key Vault Secret Access Response
SOC analyst SOP for suspicious Azure Key Vault secret and key access events. Covers bulk enumeration, anomalous caller IP, and secret exfiltration triage.
Rudra Verma, Senior Security Architect & Researcher