Cloud Service Dashboard
Cloud dashboard discovery gathers information through a management interface rather than direct command-line APIs.
What it means
Cloud dashboard discovery gathers information through a management interface rather than direct command-line APIs. Console sessions may expose the same powerful inventory and control functions.
An investigation example
An unexpected management-console session browses sensitive services and then changes access settings.
Evidence to examine
Review console authentication, audit events, resource browsing where recorded, policy changes, and account role.
A common analytical pitfall
A console login does not establish which resources were viewed if detailed visibility is unavailable.
Response considerations
Preserve management access records, protect affected sessions, and state the limits of resource-view evidence alongside confirmed changes.
A browser can expose the same management context as an API
Cloud management dashboards present services, resources, usage, and configuration to authenticated users. An intruder with a valid session may learn useful information through the interface without issuing an obvious command-line tool. Investigation should therefore consider browser and identity context alongside API audit records. The absence of a familiar CLI process is not evidence that no discovery occurred.
Dashboard access is also routine work. Assess the identity's role, session origin, expected activity, and the pages or resources involved where records support that detail. A login to the console does not by itself prove that a particular sensitive page was viewed or that data was exported. Keep the claim within available logging coverage.
A fictional unfamiliar session
An academy sees a cloud administrator session from an unexpected context. The session is followed by resource-listing events and an attempted configuration change. Analysts preserve identity and service audit records, review approved work, and determine which authority was available. The investigation distinguishes what the interface could display from what the evidence shows was actually requested.
Session containment may be needed, but coordinate it with the incident lead and preserve relevant context. Review whether the identity's permissions are appropriate and whether recovery or emergency access remains available. A dashboard is an access surface, not a separate exemption from the organization's identity and audit controls.
Compare two visibility sources
Use fictional browser history and cloud audit events from a training tenant. State which facts each can support about dashboard use. Identify a gap that would prevent claiming a specific record was read. Then propose a proportionate logging or access improvement. Do not browse another organization's management console to practice the concept.
Some dashboard actions generate service API events behind the interface, while other page views may not produce the detail an analyst expects. Understand the provider's logging coverage and the account's configuration. Do not assume that browser use is either fully invisible or perfectly recorded without checking the relevant evidence sources.
Related concepts
References & further reading
Original explanations, with primary references for deeper study.
MITRE ATT&CK T1538: Cloud Service Dashboard