Admin actions, token/app consent risk, external sharing anomalies (e.g., O365/Google Workspace)

Registry pulls, runtime anomalies, function abuse, excessive permissions

VPC/VNet flow logs, unusual geos, data-exfil patterns, risky services

CIS benchmark checks, public storage exposure, security group/firewall drift, KMS/HSM settings

IAM role changes, privilege escalation attempts, stale/over-privileged accounts, OAuth/OIDC app grants

AWS CloudTrail, Azure Activity Logs, GCP Audit Logs