Infrastructure boundaries
On this page
Infrastructure boundaries are the honest accounting of what the SOC can actually see. The point is not pessimism. It is making sure the investigation does not waste time on questions the available telemetry cannot answer.
Five kinds of infrastructure edge
Infrastructure Infrastructure The systems, networks, and services that computing runs on. In triage the word points two directions: the organization's infrastructure is what alerts fire on, and attacker infrastructure is the set of C2 servers, domains, and staging hosts an adversary operates, which pivoting on indicators is meant to map. boundaries are guardrails, not obstacles. They prevent triage from expanding into irrelevant environments, reduce noise from unrelated telemetry, and preserve analyst focus on the systems most likely to yield actionable data.
Network segmentation
Subnets, VLANs, firewall zones, and DMZs define logical containment zones. If a host is confined to a VLAN with no route to other zones, systems in those other zones can often be ruled out, unless evidence suggests segmentation failure. Systems on the same VLAN stay in scope: they are the ones it can reach. Verify segmentation as it actually behaved (firewall and flow logs), not as diagrammed, and remember that identity-based movement into cloud and SaaS does not need to cross your network boundaries at all.
System domains
Active Directory forests, Entra ID (formerly Azure AD) tenants, LDAP hierarchies. These create structural separation in authentication and policy enforcement. Recognizing domain boundaries prevents premature attribution of behavior across unrelated trust zones.
Deployment environments
Cloud workloads, on-premises systems, SaaS platforms. Each operates under distinct access, tooling, and forensic constraints. Recognizing which segments belong to which infrastructure class tailors the scope to environments with proper visibility and operational control.
Geographic and sovereignty
Data residency rules can prevent moving log data across regions. An investigation may need to be conducted in-region or by a regional team. Multinational organizations often face conflicting jurisdictions in the same case. Under GDPR, even remote viewing from outside the EEA is a transfer (see cross-border handling), and employee-monitoring rules such as works-council agreements can govern who may examine an employee’s data (see insider analysis).
Cloud and SaaS tenancy
AWS accounts and Organizations, Azure subscriptions and tenants, GCP projects and folders, SaaS tenants. These are the cloud’s segmentation, and cross-account roles, B2B guest access and OAuth apps are the doors through them. Scope names which accounts and tenants are in, and which trust paths connect them.
Access patterns
Access patterns define how identities interact with systems and resources across the environment. Within Scope, access patterns are not evaluated for anomalies. They are cataloged to understand the structural flow of authentication and authorization. This contextual map sets investigative boundaries, identifies choke points, and prevents drift into unrelated identity ecosystems.
Authentication frameworks
SSO platforms, federated identity brokers, Kerberos Kerberos Active Directory's default authentication protocol (TCP/UDP 88). The KDC on each domain controller issues a ticket-granting ticket (TGT) at logon, then service tickets for specific resources. Ticket theft (pass-the-ticket), offline cracking (Kerberoasting) and forgery (golden and silver tickets) all target this flow. Key events: 4768 (TGT), 4769 (service ticket). -based systems. These determine where authentication events originate and how access is validated. Scope identifies which authentication systems were active during the event window and what logging sources are available; without that mapping, investigations risk extending into environments sharing no credential surface with the subject.
Authorization structures
RBAC RBAC Role-Based Access Control. Permissions granted to roles rather than individual users; users inherit access through role assignment. The model makes access reviewable at the role level instead of per-user. , ABAC Attribute-Based Access Control (ABAC) Access decisions computed from attributes of the user, the resource and the context (department, data classification, device compliance, location) rather than from role membership alone. Conditional Access policies are the form analysts meet most. To explain a grant or a denial, pull the attribute values as they were at the event time. , and mandatory access control (MAC, labels set by policy rather than owners). These impose constraints on what authenticated identities can do and where. Scope accounts for these limitations so the investigation does not over-triage actions that policy would have denied. An account that lacked write permission for the whole window (checked against permission-change history, not today’s state) and shows no privilege change or denied escalation attempt can be deprioritized for questions about write actions. Denied attempts are not noise: they are evidence of intent.
Trust relationships
Domain trusts, delegated permissions, service principal access, token exchange. These bridge identity across boundaries. Documenting them distinguishes where access naturally extends from where escalation or impersonation would be required. Misinterpreting trust lines is the classic mis-scoping mistake.
An example of using access patterns to bound scope
An alert fires on an account that signs in through the corporate IdP Identity Provider (IdP) The service that authenticates users and issues the tokens or assertions other applications trust: Microsoft Entra ID, Okta, Google Workspace, Ping. Its sign-in and audit logs are first-class evidence in identity, SaaS and cloud cases, and an IdP compromise reaches every federated app. See Federation and Single Sign-On (SSO). (Okta or Entra ID) to downstream SaaS apps, Workday among them.
Without access-pattern mapping, an analyst might investigate every system the user could theoretically reach via SSO including downstream SaaS apps. That can be hundreds of systems.
With access-pattern mapping, Scope confirms:
- The user’s SSO entitlements limit federation Federation Linking identity across independent systems or organizations so that a trusted identity provider authenticates users on behalf of services it does not operate, typically via SAML or OIDC. Matters in triage because every relying service delegates authentication to the identity provider: a compromise there, such as a stolen signing key used to forge assertions (Golden SAML), can mint access to any federated service. to four specific SaaS apps.
- Two of those apps show no IdP sign-ins in the window, and their own audit logs show no active sessions or token use; neither has local accounts or API keys tied to the user.
- The other two are in scope; the rest are out.
No IdP event is not the same as no access: a session or token issued before the window, or a replayed cookie, never touches the IdP. Check app-side session logs before you exclude.
The investigation goes from “hundreds of possible targets” to “two apps with evidence of access.” That precision is what access patterns buy.
Tools as boundaries
Tooling is part of the infrastructure picture. The SOC’s coverage map should exist before any alert fires; Scope’s job is to read it for this case and record what the in-scope entities’ tools can and cannot answer.
Scope does not need the tool-by-tool catalog. That lives on Tool families in the field reference (fifteen families, with what each brings and where each is blind), and Uncover selects from it once the visibility map is drawn. What Scope needs is the answer to three questions for the tools this case will actually touch.
Coverage: which entities does it see?
The EDR sees managed endpoints, not the OT segment or the unmanaged BYOD Bring Your Own Device (BYOD) Letting staff use personally owned devices for work. A BYOD device usually has no EDR and little logging, so evidence comes from the identity provider, MAM and the apps rather than the device. Treat a sign-in from an unmanaged device as a visibility gap, not as clean. phone. Network sensors see what crosses their taps. CSPM Cloud Security Posture Management (CSPM) Tools that continuously compare cloud configuration against policy and benchmarks: public storage buckets, over-broad roles, disabled logging. A CSPM finding describes exposure, not activity; pair it with control-plane audit logs to learn whether anyone used the misconfiguration. sees the cloud accounts it is enrolled in. Any in-scope entity with no tool watching it is a named gap, not an assumption of quiet.
Retention: how far back can it answer?
SIEM retention is capacity-bounded, endpoint telemetry often keeps days to months depending on product and license, and SaaS audit history is gated by license tier. If the Scope time window extends past a tool’s retention, that stretch of the window is dark and the scope document says so.
Check whether the log exists at all, not just how long it is kept. Common default-off or tier-gated sources include CloudTrail data events, GCP Data Access audit logs, and mailbox item-access detail at lower Microsoft 365 audit tiers. A source that was never enabled is a gap for the whole window.
Retrieval: can it be queried inside the triage clock?
Packet capture may exist but take hours to pull. Disk forensics is retrospective and resource-intensive. Vendor-side SaaS logs need a request channel measured in days. A source that cannot answer within the triage window is a boundary for this phase even if the data exists somewhere.
Tools as boundary, not as scope
A platform that does not collect session data from unmanaged devices marks a hard edge in scoping. No assumptions extend beyond it. The Scope output names the tools available, what each one sees, and where each one’s vision ends. Uncover then queries within those bounds rather than chasing questions the tooling cannot answer.
Naming what is invisible
A useful Scope output is an explicit list of what the SOC cannot see for this case. To practice drawing one against a real sensor, run Lab 3.
Off-network mobile devices
Activity that happens when the device is off-corporate-network may be invisible until the device reconnects. Mobile management (MDM and MAM Mobile Application Management (MAM) Protection applied to corporate apps and their data rather than to the whole device (app PINs, copy and save restrictions, selective wipe), the usual control on personally owned phones. A MAM-only device has no device telemetry, so evidence comes from the identity provider and the apps. ) and mobile threat defense telemetry help, but not all activity reaches them.
Personal devices in BYOD
The SOC often sees only their authentication events, not deeper telemetry. App-level activity, file access, and clipboard behavior live outside corporate visibility.
Third-party SaaS without integrated logging
The SOC sees the authentication; the in-app activity is in the vendor’s logs. Deeper investigation requires a vendor request and (usually) a contractual or legal channel.
Air-gapped systems
May produce no telemetry that reaches the SIEM at all. Investigation requires direct system access, often with physical or operational constraints.
Encrypted traffic without decryption
TLS metadata (timing, volume, JA4 JA4 The 2023 successor to JA3 from FoxIO (FoxIO-LLC/ja4). A TLS-client fingerprint that sorts ciphers and extensions before hashing, so it stays consistent across connections from the same client build despite randomization. It handles TLS 1.3 and marks the transport with a leading "t" (TLS over TCP), "q" (QUIC) or "d" (DTLS). Part of the JA4+ suite, which adds separate fingerprints such as JA4H (HTTP client) and JA4S (TLS server). JA4 itself is BSD-3-Clause open source; the other JA4+ methods use the FoxIO License (free for internal use, licensed for commercial products), so check before embedding them in a product. or legacy JA3 client fingerprints, and the SNI unless Encrypted Client Hello hides it) is visible; payload content is not. ECH (RFC 9849, 2026) and DNS-over-HTTPS increasingly hide destination names from network sensors. C2 riding on legitimate TLS looks like other TLS unless inspection sits upstream or the endpoint sees it.
Legacy systems without modern agents
Mainframes, operational technology and industrial control systems (OT/ICS), and embedded systems often cannot host EDR. Coverage is via network position or via the system’s own audit features, which may be limited. On OT and ICS networks, safety and availability come first: no active scanning, agent pushes or host isolation from the SOC. Containment goes through the process’s engineering owner, who decides what can safely be touched.
Hypervisors and management planes
ESXi hosts and vCenter run no EDR and keep short local logs. Forward their syslog, or it is gone.
Edge appliances
VPN concentrators, firewalls, and load balancers run a vendor OS with limited logging, and they are a favored espionage foothold.
Ephemeral workloads
Containers and serverless functions: the host may not exist by query time. Rely on control-plane and runtime logs.
SaaS-to-SaaS integrations and AI agents
Actions taken with delegated tokens appear as the user or the app, often only in the vendor’s logs.
Listing gaps is not an apology
Absence of telemetry is not absence of activity. Naming what cannot be seen is a deliberate statement that frames the investigation realistically. It prevents the analyst from chasing impossible queries, and it signals to escalation when an investigation has reached the limit of what the available telemetry can prove.
Key takeaway
Infrastructure boundaries are the honest map of the SOC’s vision. Naming them (network, identity, tenancy, geography, tooling, and above all the gaps) is Scope’s last responsibility before Uncover takes the work forward, because Uncover can only query what the environment can actually answer.
Next up
Scope working example
Scope applied to the three cases that ran through Alert and Subject: an expanding boundary, a deliberately narrow one, and one drawn in log queries.
See the exampleTechnical details verified . Product names, defaults and retention change; check your own tenant.