Cloud Incident Response Playbook — Wiz + Palo Alto Cortex XDR

Analyst: Oluwaseyi Michael Falode — Cloud & Cybersecurity Engineer Platforms: Wiz CNAPP + Palo Alto Networks Cortex XDR (Simulated) Cloud Environment: Amazon Web Services (AWS) — Hybrid Enterprise Date: May 2026 Classification: Portfolio Project

---

Overview

This playbook documents the end-to-end detection, investigation, containment, eradication, and recovery response to a simulated Toxic Combination cloud security incident on AWS.

A Toxic Combination is Wiz's term for a cluster of individually moderate security issues that together form a critical, directly exploitable attack path. In this scenario, three medium-severity findings converged to create a 9.8/10 CRITICAL risk — a direct path from the public internet to full AWS account compromise.

Outcome: Wiz detected the Toxic Combination within 4 minutes. Cortex XDR automated containment isolated the EC2 and revoked the IAM role within 9 minutes — stopping the attack before any data left the environment.

---

The Toxic Combination

Three co-existing findings, each medium in isolation, combined to create a catastrophic attack path:

#	Resource	Finding	Individual Severity	Wiz Risk Score
1	S3: prod-hr-data-2024	Bucket ACL set to public-read — 847,000 customer records + HR payroll data for 3,200 employees, unencrypted at rest	MEDIUM	6.4 / 10
2	EC2: i-0a1b2c3d4e5f	CVE-2021-44228 (Log4Shell, CVSS 10.0) — unpatched, internet-reachable on port 8080, connected to the sensitive S3 bucket	MEDIUM	7.1 / 10
3	IAM: EC2-Production-Role	AdministratorAccess attached to the EC2 — full read/write across the entire AWS account	MEDIUM	6.8 / 10

Combined Wiz Risk Score: 9.8 / 10 — CRITICAL

Attack Path: Public internet → Log4Shell exploit on EC2 → IMDS credential theft → AdministratorAccess IAM credentials → Full AWS account compromise in under 15 minutes.

---

Tool Architecture

Wiz (CNAPP)

• Connects to AWS via agentless, read-only IAM role — no agents on any resource
• Builds a Security Graph mapping all 500 EC2s, 120 S3 buckets, and 340 IAM identities and their relationships
• CSPM Engine continuously checks against CIS AWS Benchmark and AWS Well-Architected Framework
• Toxic Combination Engine correlates findings across the graph to surface multi-factor attack paths
• Forwards CRITICAL alerts to Cortex XDR via webhook API with full context

Palo Alto Networks Cortex XDR

• Receives Wiz webhook → creates Priority 1 incident automatically
• Correlates cloud finding against endpoint telemetry, VPC flow logs, and Unit 42 threat intelligence
• XSOAR automation playbook triggers EC2 network isolation and IAM role revocation without human intervention

---

Attack Path Analysis (MITRE ATT&CK Cloud Matrix)

Step	Attacker Action	MITRE Technique	Wiz Detects	Cortex XDR Detects
1	Reconnaissance — scans EC2 port 8080	T1595 — Active Scanning	Network exposure in Security Graph	Inbound port scan in VPC flow logs
2	Exploits Log4Shell via JNDI injection	T1190 — Exploit Public-Facing Application	CVE flagged on EC2	Anomalous Java child process on endpoint
3	Queries IMDS for IAM credentials	T1552.005 — Cloud Instance Metadata API	IAM over-privilege in Security Graph	Unusual curl to 169.254.169.254
4	Uses stolen Admin credentials	T1078.004 — Valid Cloud Accounts	Toxic Combination CRITICAL alert fired	Priority 1 incident created
5	Downloads S3 bucket contents	T1530 — Data from Cloud Storage	S3 public access + data sensitivity flagged	Mass S3 GetObject API calls — containment triggered
6	CONTAINED — EC2 isolated, IAM revoked	N/A	N/A	Automated containment applied

---

Incident Response Procedure

Phase 1 — Detection (T+4 min)

• Wiz Security Graph detects Toxic Combination, fires CRITICAL alert
• Webhook forwarded to Cortex XDR → Priority 1 incident created, analyst paged via PagerDuty

Phase 2 — Containment (T+9 min)

1. S3 Block Public Access applied to prod-hr-data-2024
2. Cortex XDR network isolation applied to EC2 i-0a1b2c3d4e5f
3. XSOAR removes AdministratorAccess from EC2-Production-Role — replaced with deny-all
4. All IAM temporary credentials issued in prior 12 hours invalidated
5. VPC flow logs, CloudTrail, and endpoint logs archived with object lock

Phase 3 — Investigation

• CloudTrail: 1,847 S3 GetObject calls against prod-hr-data-2024, 2 failed IAM CreateUser attempts
• Cortex XDR endpoint timeline: Log4Shell payload at 14:28 → bash shell at 14:29 → IMDS query at 14:30 → aws s3 sync at 14:31 → containment at 14:41
• VPC flow logs: no completed exfiltration transfer — no data breach confirmed
• Attacker IP 185.220.101.47: known Tor exit node, Unit 42 prior Log4Shell exploitation history

Phase 4 — Eradication

• EC2 rebuilt from clean AMI with Log4j patched to 2.17.1
• EC2-Production-Role rebuilt with least-privilege: s3:GetObject and s3:PutObject on prod-hr-data-2024 only
• IMDSv2 enforced on all EC2 instances across the account
• S3 encryption enabled via AWS KMS; Block Public Access enabled at account level
• 12 additional overprivileged IAM roles identified and remediation tickets raised

Phase 5 — Recovery & Lessons Learned

• EC2 returned to production after security validation
• Confirmed near-miss — no PIPEDA breach notification required
• New Wiz CSPM policy: alert within 1 hour of any CVSS 9.0+ CVE + internet-exposed EC2 + IAM role attached
• XSOAR playbook updated: auto-quarantine any EC2 making 100+ S3 GetObject calls in 5 minutes outside business hours

---

Recommendations

Priority	Recommendation	Addresses
CRITICAL	Enforce IAM least privilege — audit all EC2 roles, remove AdministratorAccess, implement IAM Access Analyzer	Finding 3 — IAM
CRITICAL	Enforce IMDSv2 on all EC2 via AWS Organizations SCP	Finding 2 — CVE
CRITICAL	Automated patch management for application dependencies — integrate Wiz scanning into CI/CD pipeline	Finding 2 — CVE
HIGH	Enable S3 Block Public Access at AWS Organizations level	Finding 1 — S3
HIGH	Configure Wiz Toxic Combination policies with 15-minute alert threshold	All Findings
HIGH	Deploy Cortex XDR XSOAR playbook for automated cloud containment — target: 5-min containment	Response Speed

Full implementation of these recommendations reduces the attack path exploitability from CRITICAL (9.8) to LOW (1.2) on the Wiz risk scale.

---

MITRE ATT&CK Techniques Covered

T1595 T1190 T1552.005 T1078.004 T1530 T1098

---

Tools & Frameworks

• Wiz — CNAPP, CSPM, Security Graph, Toxic Combination Engine, Vulnerability Scanner
• Palo Alto Networks Cortex XDR — XDR, XSOAR, Endpoint Agent, Network Analytics, Unit 42 Threat Intelligence
• MITRE ATT&CK Cloud Matrix
• CIS AWS Benchmark
• AWS Well-Architected Security Pillar
• Cloud Environment: AWS — 500 EC2s, 120 S3 buckets, 340 IAM identities, 3 regions

---

About This Project

This is a portfolio cloud incident response playbook demonstrating hands-on knowledge of enterprise cloud security tooling (Wiz + Cortex XDR), AWS attack paths, MITRE ATT&CK Cloud mapping, and structured IR methodology — the same approach used by cloud security engineers and incident responders in enterprise SOC environments.