Cloud containment actions
5 actions in the scorecard's Cloud domain: which of eighteen platforms document each against a named target, and the vendor page that shows it. Read 2026-11-03 and 2026-11-04.
5actions
The grid for this domain
- native, vendor-documented
- partner or third-party documented
- custom step only
- not documented on the pages read
| Platform | Cloud | ||||
|---|---|---|---|---|---|
| Disable IAM user or access key | Revoke cloud session | Isolate or stop an instance | Change a security group or firewall rule | Revoke OAuth app consent | |
| Palo Alto Cortex XSOAR4 of 5 documented | Palo Alto Cortex XSOAR: Revoke cloud session, not documented | ||||
| Tines4 of 5 documented | Tines: Revoke OAuth app consent, not documented | ||||
| D3 Security3 of 5 documented | D3 Security: Disable IAM user or access key, not documented | D3 Security: Revoke cloud session, not documented | |||
| Google Security Operations3 of 5 documented | Google Security Operations: Revoke cloud session, not documented | Google Security Operations: Revoke OAuth app consent, not documented | |||
| Splunk SOAR (Cisco)3 of 5 documented | Splunk SOAR (Cisco): Revoke cloud session, not documented | Splunk SOAR (Cisco): Revoke OAuth app consent, not documented | |||
| Swimlane3 of 5 documented | Swimlane: Revoke cloud session, not documented | Swimlane: Revoke OAuth app consent, not documented | |||
| Torq3 of 5 documented | Torq: Revoke cloud session, not documented | Torq: Revoke OAuth app consent, not documented | |||
| Microsoft Sentinel2 of 5 documented | Microsoft Sentinel: Disable IAM user or access key, not documented | Microsoft Sentinel: Revoke cloud session, not documented | Microsoft Sentinel: Revoke OAuth app consent, not documented | ||
| ServiceNow Security Operations2 of 5 documented | ServiceNow Security Operations: Revoke cloud session, not documented | ServiceNow Security Operations: Change a security group or firewall rule, not documented | ServiceNow Security Operations: Revoke OAuth app consent, not documented | ||
| BlinkOps1 of 5 documented, not ranked | BlinkOps: Revoke cloud session, not documented | BlinkOps: Revoke OAuth app consent, not documented | |||
| Cyware1 of 5 documented | Cyware: Revoke cloud session, not documented | Cyware: Isolate or stop an instance, not documented | Cyware: Change a security group or firewall rule, not documented | Cyware: Revoke OAuth app consent, not documented | |
| CrowdStrike Falcon Fusion SOAR0 of 5 documented, docs behind login | CrowdStrike Falcon Fusion SOAR: Disable IAM user or access key, not documented | CrowdStrike Falcon Fusion SOAR: Revoke cloud session, not documented | CrowdStrike Falcon Fusion SOAR: Isolate or stop an instance, not documented | CrowdStrike Falcon Fusion SOAR: Change a security group or firewall rule, not documented | CrowdStrike Falcon Fusion SOAR: Revoke OAuth app consent, not documented |
| Dropzone AI0 of 5 documented | Dropzone AI: Disable IAM user or access key, not documented | Dropzone AI: Revoke cloud session, not documented | Dropzone AI: Isolate or stop an instance, not documented | Dropzone AI: Change a security group or firewall rule, not documented | Dropzone AI: Revoke OAuth app consent, not documented |
| Exabeam0 of 5 documented, not ranked | Exabeam: Disable IAM user or access key, not documented | Exabeam: Revoke cloud session, not documented | Exabeam: Isolate or stop an instance, not documented | Exabeam: Change a security group or firewall rule, not documented | Exabeam: Revoke OAuth app consent, not documented |
| Mate Security0 of 5 documented | Mate Security: Disable IAM user or access key, not documented | Mate Security: Revoke cloud session, not documented | Mate Security: Isolate or stop an instance, not documented | Mate Security: Change a security group or firewall rule, not documented | Mate Security: Revoke OAuth app consent, not documented |
| Prophet Security0 of 5 documented | Prophet Security: Disable IAM user or access key, not documented | Prophet Security: Revoke cloud session, not documented | Prophet Security: Isolate or stop an instance, not documented | Prophet Security: Change a security group or firewall rule, not documented | Prophet Security: Revoke OAuth app consent, not documented |
| Revelstoke (Arctic Wolf)0 of 5 documented, not ranked | Revelstoke (Arctic Wolf): Disable IAM user or access key, not documented | Revelstoke (Arctic Wolf): Revoke cloud session, not documented | Revelstoke (Arctic Wolf): Isolate or stop an instance, not documented | Revelstoke (Arctic Wolf): Change a security group or firewall rule, not documented | Revelstoke (Arctic Wolf): Revoke OAuth app consent, not documented |
| ThreatConnect0 of 5 documented, not ranked | ThreatConnect: Disable IAM user or access key, not documented | ThreatConnect: Revoke cloud session, not documented | ThreatConnect: Isolate or stop an instance, not documented | ThreatConnect: Change a security group or firewall rule, not documented | ThreatConnect: Revoke OAuth app consent, not documented |
8of 18 document it
Disable IAM user or access key
Disable a cloud IAM user, login profile, service account or access key.
Typical targets: AWS IAM, Google Cloud IAM, Azure RBAC.
- Palo Alto Cortex XSOAR, native: Google Cloud IAM: gcp-iam-service-account-disable, gcp-iam-service-account-key-disable; AWS IAM: aws-iam-update-access-key, aws-iam-delete-login-profile. github.com, read
- Tines, native: AWS IAM: Delete Access Key, Attach AWS Deny All Policy templates. tines.com, read
- Google Security Operations, native: Google Cloud IAM: Disable Service Account; AWS IAM: Disable User Access. cloud.google.com, read
- Splunk SOAR (Cisco), native: AWS IAM: disable user. github.com, read
- Swimlane, native: Amazon AWS IAM: Disable Access Key. docs.swimlane.com, read
- Torq, native: AWS IAM: Delete an IAM User Account template; Google Cloud Identity: Disable a Specific User template. kb.torq.io, read
- ServiceNow Security Operations, native: AWS IAM spoke: Delete Access Key for User, Delete Login Profile, Delete User. servicenow.com, read
- Cyware, native: AWS IAM: Delete Access Key. techdocs.cyware.com, read
Custom step only: BlinkOps. AWS: Run AWS CLI Script step; AWS: IAM Put User Policy
Not documented on the pages read (9): D3 Security, Microsoft Sentinel, CrowdStrike Falcon Fusion SOAR, Dropzone AI, Exabeam, Mate Security, Prophet Security, Revelstoke (Arctic Wolf), ThreatConnect.
1of 18 document it
Revoke cloud session
Invalidate active cloud sessions or temporary credentials issued to a principal.
Typical targets: AWS IAM (role session revocation), Google Cloud IAM, Azure.
- Tines, native: AWS IAM: Revoke AWS IAM Role Sessions template. tines.com, read
Not documented on the pages read (17): Palo Alto Cortex XSOAR, D3 Security, Google Security Operations, Splunk SOAR (Cisco), Swimlane, Torq, Microsoft Sentinel, ServiceNow Security Operations, BlinkOps, Cyware, CrowdStrike Falcon Fusion SOAR, Dropzone AI, Exabeam, Mate Security, Prophet Security, Revelstoke (Arctic Wolf), ThreatConnect.
10of 18 document it
Isolate or stop an instance
Stop, power off or network-isolate a compute instance.
Typical targets: AWS EC2, Azure Virtual Machines, Google Compute Engine.
- Palo Alto Cortex XSOAR, native: AWS EC2: aws-ec2-stop-instances; Google Compute Engine: gcp-compute-stop-instance; Azure Compute: azure-vm-poweroff-instance. github.com, read
- Tines, native: AWS: Stop AWS EC2 Instance template. tines.com, read
- D3 Security, native: AWS EC2: Quarantine EC2 Instances. docs.d3security.com, read
- Google Security Operations, native: AWS EC2: Stop Instance, Terminate Instance; Google Cloud Compute: Stop Instance. cloud.google.com, read
- Splunk SOAR (Cisco), native: AWS EC2: stop instance, detach instance; Microsoft Azure Compute: stop vm, deallocate vm. github.com, read
- Swimlane, native: Amazon AWS EC2: stop instance; Microsoft Azure Virtual Machines: Power Off Virtual Machines. docs.swimlane.com, read
- Torq, native: AWS EC2: Isolate an AWS EC2 Instance by using tags template. kb.torq.io, read
- Microsoft Sentinel, native: Azure VM (Logic Apps connector): Deallocate virtual machine; Isolate-AzureVMtoNSG playbook template. learn.microsoft.com, read
- ServiceNow Security Operations, native: Amazon EC2 spoke: Stop Instances; Microsoft Azure Virtual Machine spoke: Power Off Virtual Machine. servicenow.com, read
- BlinkOps, native: AWS: EC2 Stop Instances; Google Cloud: Suspend Compute Instance; Azure: Stop Virtual Machine. docs.blinkops.com, read
Not documented on the pages read (8): Cyware, CrowdStrike Falcon Fusion SOAR, Dropzone AI, Exabeam, Mate Security, Prophet Security, Revelstoke (Arctic Wolf), ThreatConnect.
8of 18 document it
Change a security group or firewall rule
Add or remove a rule in a cloud security group, network security group or cloud firewall.
Typical targets: AWS EC2 security groups, Azure network security groups, Google Cloud firewall.
- Palo Alto Cortex XSOAR, native: AWS EC2: aws-ec2-revoke-security-group-ingress-rule, aws-ec2-authorize-security-group-ingress-rule; Azure NSG: azure-nsg-security-rule-update, azure-nsg-security-rule-create. github.com, read
- Tines, native: AWS: Revoke AWS EC2 Security Group Rules, Set AWS EC2 Security Group templates. tines.com, read
- D3 Security, native: Azure Network Security Groups: Block IPs; AWS EC2: Block IPs By VPC ACL. docs.d3security.com, read
- Google Security Operations, native: AWS EC2: Revoke Security Group Ingress, Authorize Security Group Ingress; Google Cloud Compute: Update Firewall Rule, Add IP To Firewall Rule. cloud.google.com, read
- Splunk SOAR (Cisco), native: AWS EC2: create security group, delete security group, add acl, remove acl; Microsoft Azure Compute: add network group. github.com, read
- Swimlane, native: Amazon AWS EC2: security group actions; Microsoft Azure Virtual Network: network security group actions. docs.swimlane.com, read
- Torq, native: AWS: Handle AWS Security Group with Open SSH Access template. kb.torq.io, read
- Microsoft Sentinel, native: Isolate-AzureVMtoNSG playbook template (creates and applies a Deny All NSG). raw.githubusercontent.com, read
Custom step only: BlinkOps. AWS: Run AWS CLI Script step; AWS: EC2 Create Security Group, Delete Security Group
Not documented on the pages read (9): ServiceNow Security Operations, Cyware, CrowdStrike Falcon Fusion SOAR, Dropzone AI, Exabeam, Mate Security, Prophet Security, Revelstoke (Arctic Wolf), ThreatConnect.
2of 18 document it
Revoke OAuth app consent
Remove a delegated consent grant or enterprise application so a third-party OAuth app loses access.
Typical targets: Microsoft Entra ID (OAuth2 permission grants, service principals), Google Workspace, Okta.
- Palo Alto Cortex XSOAR, native: Microsoft Graph Applications: msgraph-apps-service-principal-remove, msgraph-apps-service-principal-password-remove. github.com, read
- D3 Security, native: Microsoft Entra ID: Delete OAuth2 Permission Grants. docs.d3security.com, read
Not documented on the pages read (16): Tines, Google Security Operations, Splunk SOAR (Cisco), Swimlane, Torq, Microsoft Sentinel, ServiceNow Security Operations, BlinkOps, Cyware, CrowdStrike Falcon Fusion SOAR, Dropzone AI, Exabeam, Mate Security, Prophet Security, Revelstoke (Arctic Wolf), ThreatConnect.