SOP-44: Azure Key Vault Secret Access Response

SOC analyst SOP for suspicious Azure Key Vault secret and key access events. Covers bulk enumeration, anomalous caller IP, and secret exfiltration triage.

2026-07-18T06:56:20.323Z
Rudra Verma, Senior Security Architect & Researcher