An incident responder can detect storage-related security incidents in the cloud by monitoring and thoroughly analyzing file systems and storage units’ metadata for malicious content.