Mandiant's David Pany & Caitlin Hanley describe a hypothetical scenario of a cloud platform compromise with multiple components that would require investigation, in order to identify event log configurations that should be reviewed. https://www.mandiant.com/resources/blog/cloud-bad-log-configurations