HackBlue

Tools · Incident response playbooks · 20 / 20

Playbook: a vendor or SaaS provider you use reports a breach

When a supplier announces a security incident, inventory what you share with them, rotate integration credentials, hunt for misuse of their access, and track their disclosures.

9 min read · practice only with authorization

What do they have?

Start by answering: what data do we store with them, what credentials do they hold for our systems (API keys, OAuth tokens, SSO integrations, VPN accounts), and what software of theirs runs inside our environment? A vendor inventory with owners and integration details makes this a quick lookup instead of a scramble.

Act on integrations

Rotate API keys and secrets shared with the vendor, revoke and re-issue OAuth tokens, review their SSO application permissions, and restrict network access from their IP ranges if they connect inward. If their software runs on your hosts, check vendor advisories for indicators and apply patches or isolate the component.

Lab: hunt for integration misuse

Pick one SaaS integration in a lab tenant, such as a service principal or OAuth app. Find its sign-ins and API activity for the last 30 days, establish what normal looks like (source IPs, operations, times), and write a query that flags activity outside that pattern. Then rotate its secret and confirm the old secret stops working.

Snippet
// Entra ID service principal sign-ins
AADServicePrincipalSignInLogs
| where TimeGenerated > ago(30d) and ServicePrincipalName == "Vendor-Sync-App"
| summarize Count = count(), IPs = make_set(IPAddress, 20), Resources = make_set(ResourceDisplayName, 10) by bin(TimeGenerated, 1d)

# rotate a client secret (Azure CLI)
az ad app credential reset --id <app-id> --append false

Track and follow up

Follow the vendor’s official advisories and support channel rather than social media. Ask for indicators, affected time windows, and whether your data was involved. Record decisions and evidence in your incident log, assess notification duties with legal if your customers’ data was affected, and update contracts and security requirements afterward.

Diagram

Vendor breach response

  1. Inventory

    Data shared, credentials held, software deployed.

  2. Rotate and restrict

    Keys, tokens, SSO permissions, network access.

  3. Hunt

    Look for misuse of the vendor’s access in your logs.

  4. Track

    Follow official advisories; assess notification; update contracts.

Check yourself

1. What makes a vendor breach response fast?

2. A breached vendor held an API key for your system. What should you do?

3. Where should you get indicators and status about the vendor incident?