The SolarWinds Orion breach: 6 ideas on what to do next and why

This note analyzes the SolarWinds Orion (SUNBURST) supply-chain compromise and provides operational guidance: organizations must rewind telemetry to search for historical compromise, account for data retention shortcomings, leverage vendor detections and EDR for remote forensics, and hunt for post-compromise TTPs (Azure AD PowerShell behavior, federation trust modifications, forged SAML tokens, anomalous logins, lateral movement and privilege escalation). The authors report widespread potential impact, praise rapid vendor detection development, and note no observed recent SUNBURST C2 in their limited telemetry.