How do I identify whether cloud activity was automated?¶

Identify automation by examining the application, service account, token, API event, schedule and pattern behind the cloud activity.

Evidential caution: that activity under a named user account was performed manually by that user.

What this means¶

Synchronisation tools, scripts, workflows, backup services, security platforms and connected applications can create, move, access or delete data automatically.

Review application consent, token use, service-account permissions, automation rules and administrator configuration.

A person may have created, approved or misconfigured the process.

Where attribution matters, distinguish the person who configured the automation from the system that executed the later event.

Where the automation ran under a user token, check whether the user had to be present when the token was first issued. Later execution may occur independently of the user.

Automation can also be triggered by another user action or external event. Identify the initiating event as well as the process that executed the later cloud activity.

What to check or do next¶

• Start with the event type and application or client ID.
• Check whether the action occurred through a browser, API, service account, mobile app or background sync client.
• Look for repeated timing, high-volume activity, regular intervals and actions occurring when the user was unlikely to be active.
• Compare the cloud record with application logs, task schedules, device records and change-management documentation.

Evidential limits¶

Do not assume that automation removes human responsibility entirely.