Incident support

Responding to a suspected AWS incident?

XSEE can help your team see which identities, permissions and resources are reachable in the affected account, using a read-only IAM role. Contact us to discuss your situation.

Contact our team

How we can help

  1. Contact our team
    Email us with what you can share. We will reply to discuss whether XSEE is a fit for your situation.
  2. Connect a read-only IAM role
    No agents are installed. Your team keeps control and can revoke access by deleting the role.
  3. Review reachable paths
    XSEE maps identities, permissions and network exposure, and labels each step by what was checked. It is not a forensic or intrusion-detection tool.
  4. Your team decides on containment
    XSEE does not make changes in your account. Your responders choose and apply any actions.

General first steps

General guidance only — not a substitute for your incident response plan or professional advice.

  • Follow your organization's incident response plan and involve your security lead.
  • Revoke or rotate any IAM access keys you suspect are compromised.
  • Confirm CloudTrail is enabled in all regions and review recent IAM activity such as AssumeRole, CreateUser and AttachUserPolicy.
  • Consider isolating a suspected instance by restricting its security group rather than terminating it, to preserve evidence.
  • Contact AWS Support if you need help from AWS.