A machine learning detector analyzing cloud audit logs flags unusual API calls from a service account that normally runs a nightly backup job. The calls began an hour ago and include listing storage buckets the account has never accessed. What should the security analyst do next?

Machine learning threat detection identifies anomalies and patterns that rules may miss, such as a service account suddenly enumerating storage it has never used. Its output is a probabilistic signal, not a confirmed verdict: models produce false positives when behavior changes legitimately and can be manipulated or drift over time. The correct next step is prompt triage, correlating the alert with other evidence such as the source of the calls, recent credential use, configuration changes, the account's permissions and related alerts, and then deciding on proportionate containment, which may be quick if the evidence supports compromise. Deleting the account immediately treats the detection as certain, could break a legitimate backup process, and destroys context investigators may need. Waiting for repeated alerts over several days leaves a possibly compromised identity active while data may be exfiltrated. Retraining the model to exclude the account suppresses the very signal that may indicate an attack and creates a permanent blind spot. Exam caveat: the 2026 outline adds AI and ML for cloud threat detection and analysis, and exam answers favor human judgment over blind automation for consequential actions. Operational check: record the triage outcome and feed confirmed false positives back into tuning through a reviewed process.