Cloud Investigation and Response Automation evaluation questionnaire

1. RFIWhat cloud-native evidence sources does the platform automatically collect and preserve during an investigation (CloudTrail/Activity Logs, VPC flow logs, container runtime state, IAM change history) — and is collection triggered automatically on detection, or does an analyst need to manually initiate evidence gathering after the fact (risking evidence loss/log rotation in the meantime)?
   Answer key — what a strong answer shows

   Automatic evidence collection triggered on detection is materially stronger than manual initiation, since cloud logs often have short retention/rotation windows that can destroy evidence before a human gets to it.

2. RFPDescribe automated response/containment actions available specifically for cloud-native attack chains (e.g., isolate a compromised container, revoke a compromised IAM credential, snapshot a compromised instance for forensics before terminating it) and whether these are triggered automatically under defined conditions or always require manual analyst approval.
   Answer key — what a strong answer shows

   Ask specifically which response actions are automatable versus which always require human approval, and for a real incident example where automated response measurably reduced dwell time.

3. RFIHow does the platform reconstruct a full attack timeline across multiple cloud services and accounts (e.g., an attacker pivoting from a compromised Lambda function to S3 data access to a cross-account role assumption) — is this automated correlation, or does the analyst manually stitch together separate log sources?
   Answer key — what a strong answer shows

   Automated cross-service, cross-account timeline correlation is the core value proposition of this category over manually querying each cloud service's logs separately during a live incident.

4. RFPDetail multi-cloud support (AWS, Azure, GCP) — is investigation/response capability at parity across all three, or is coverage deepest on one provider with materially thinner support elsewhere?
   Answer key — what a strong answer shows

   Strong answers are candid about coverage gaps between cloud providers; a customer with a genuinely multi-cloud environment needs to know where the real depth is, not just that all three are nominally 'supported.'

5. RFIWhat is the platform's handling of ephemeral cloud resources (containers, serverless functions, autoscaling instances that may terminate before or during an investigation) — can evidence still be captured and attributed correctly for a resource that no longer exists by the time an analyst looks at the incident?
   Answer key — what a strong answer shows

   Ephemeral resource evidence capture is a genuinely hard, category-defining problem; ask specifically how the platform handles investigation of a resource that's already gone, since this is common in auto-scaling cloud environments.

6. RFPExplain integration with the broader SOC workflow — does an incident detected and investigated here automatically create a case in the existing SIEM/SOAR/ticketing system with full context, or does the analyst need to manually re-create the incident record in a separate tool?
   Answer key — what a strong answer shows

   Automatic case creation with full context in the existing SOC tooling avoids duplicate work and lost context; a standalone tool requiring manual re-entry into the primary incident-tracking system is a real workflow friction point.

7. RFIWhat is the pricing model — per cloud account, per investigation, or based on telemetry volume — and how does cost scale as the customer's cloud footprint and investigation frequency both grow?
   Answer key — what a strong answer shows

   Look for transparent, predictable scaling economics; telemetry-volume-based pricing that spikes when the customer expands logging coverage (otherwise good security practice) creates a perverse cost incentive to under-log.

8. RFPWhat compliance-evidence generation exists from investigation/response activity (evidence that cloud incident-response capability was active and effective, for a SOC 2 or similar audit), and is this a built-in exportable report or something the customer must assemble manually?
   Answer key — what a strong answer shows

   Native compliance-evidence generation is materially more valuable than raw investigation logs requiring manual compilation for every audit cycle.

9. RFIDetail historical trend reporting on investigation volume and cloud-incident-pattern trends over time, suitable for demonstrating program value to leadership.
   Answer key — what a strong answer shows

   Trend-over-time reporting is a distinct capability from individual investigation reports — confirm this exists as a maintained, exportable report.

10. RFPWho within the security team gets access to investigation data and evidence, and is there role-based access control given the sensitivity of cloud forensic data and any potential legal/HR implications of an investigation?
    Answer key — what a strong answer shows

    Investigation evidence can have real legal consequences and reveal sensitive operational details — role-based access control over this specific asset is an often-overlooked consideration.

11. RFIWhat is the measured false-positive rate on automated containment actions specifically (isolating a resource or revoking a credential that turns out to be legitimate activity), and what safeguards prevent an incorrect automated action from causing a production outage?
    Answer key — what a strong answer shows

    A false positive with automated containment can cause real production disruption — ask for a real, customer-validated false-positive figure and explicit safety guardrails against incorrect automated actions.

12. RFIHow does this platform relate to the customer's existing CDR/CNAPP tooling — is investigation/response automation a genuinely distinct, forensics-focused complementary layer, or does it substantially duplicate detection/response capability those platforms already provide?
    Answer key — what a strong answer shows

    This is a real, common buyer question given the functional overlap with CDR and CNAPP's own response capabilities — a vendor should give an honest answer about the boundary and complementarity.

13. RFPWhat is a customer-referenced onboarding timeline from contract signature to the platform providing genuinely useful, automated investigation capability across an existing, non-trivial multi-cloud footprint?
    Answer key — what a strong answer shows

    Strong answers give a concrete, customer-validated timeline for a realistic existing-footprint scenario (not a small greenfield deployment) and are honest about the customer-side configuration effort required.

14. RFIWhat is the data-portability/migration path for historical investigation records and evidence if the customer later switches providers — can this data be exported in a usable format, or does it remain locked in the outgoing vendor's platform?
    Answer key — what a strong answer shows

    Investigation records may have ongoing legal/compliance retention value — a vendor with no clear data-portability answer creates real vendor lock-in risk for historically significant forensic records.

Verified buyers can suggest criteria (anonymized before pooling).