Identity Forensic Snapshot

Identity Forensic Snapshot is a security investigation artifact that captures system state for later review for user and workload identity. It uses logs, configuration, hashes, and time-bounded data so teams can analyze incidents without changing evidence while keeping evidence, reliability, and public-safe operational boundaries clear.

“The security team used Identity Forensic Snapshot when a service account requested access, so the team could analyze incidents without changing evidence before the risk review began.”