Cloud triage

Cloud's process-lineage analogue is:

IDENTITY + API CALL + RESOURCE + SOURCE + SEQUENCE

Question	Establish
Who	User, role, service principal, managed identity, access key
What	API/action and result
Where	Source IP, region, account/subscription
Target	Resource and data
Authentication	MFA, temporary credentials, assumed role, token
Sequence	Actions immediately before and after

Priority order

1. Identity and authentication
2. API/activity logs
3. Privilege/IAM changes
4. Resource/configuration changes
5. Network/security controls
6. Data access
7. Persistence
8. Exfiltration indicators
9. Scope across accounts, subscriptions, and resources

Pivot next: credential issuance, role assumption, related identities, control-plane history, data-plane events, network flow, and defensive-control changes.