In this session, we will share our experience of investigation based on a real IR case, also share the different behaviors betweeen cloud platforms and normal enviroments. In conclusion, we will mention how to enhance operate monitoring and architecture security based on the case.