Using Splunk in Automating Forensic Investigations in AWS
[Pages:43]Using Splunk in Automating Forensic Investigations in AWS
? 2019 SPLUNK INC.
David Rutstein
Principal Incident Responder | GE Digital - Predix
Alina Dejeu
Sr. Incident Responder | GE Digital - Predix
ForwardLooking Statements
? 2019 SPLUNK INC.
During the course of this presentation, we may make forward-looking statements regarding future events or plans of the company. We caution you that such statements reflect our current expectations and estimates based on factors currently known to us and that actual events or results may differ materially. The forward-looking statements made in the this presentation are being made as of the time and date of its live presentation. If reviewed after its live presentation, it may not contain current or accurate information.We do not assume any obligation to update any forward-looking statements made herein.
In addition, any information aboutour roadmap outlines our general product direction and is subject to change at any time without notice. It is for informational purposes only, and shall not be incorporated into any contract or other commitment. Splunk undertakes no obligation either to develop the features or functionalities described or to include any such feature or functionality in a future release.
Splunk, Splunk>, Turn Data Into Doing, The Engine for Machine Data, Splunk Cloud, Splunk Light and SPL are trademarks and registered trademarks of Splunk Inc. in the United States and other countries.All other brand names,productnames, or trademarks belong to their respective owners. ? 2019 Splunk Inc. All rights reserved.
? 2019 SPLUNK INC.
The Story So Far...
How did we get here?
Forensics App Backstory
How this app came to be
Splunkbase already contains an abundance of content to analyze forensic evidence ? Issues:
? Most are for windows based forensics evidence ? Only work for specific outputs (i.e. Volatility files) ? Contain a lot of custom Javascript / Python files
? 2019 SPLUNK INC.
Best Practices
Building the Toolset
? Memory
Volatile data from the EC2 instance's virtual memory
? 2019 SPLUNK INC.
? Volatility, Margarita Shotgun, LiME, enCase
? OS Artifacts
Various commands run against the virtual hard drive and outputting the content to a file
? Super Timelines
Forensics timeline analysis
? Sleuth Kit, GRR, Loki ? Plaso/Log2Timeline
Setup
? 2019 SPLUNK INC.
OS-Artifacts
Default layout
? 2019 SPLUNK INC.
OS-Artifacts
Build a lookup based on best practices
? 2019 SPLUNK INC.
Correlate the artifacts pulled from the host with forensics best practices and flag as appropriate.
................
................
In order to avoid copyright disputes, this page is only a partial summary.
To fulfill the demand for quickly locating and searching documents.
It is intelligent file search solution for home and business.
Related download
- using splunk in automating forensic investigations in aws
- geant4 installation guide documentation
- amazon corretto corretto 11 user guide
- the world area forecast system wafs internet file
- lab exercise tcp kevin curran
- hacking with kali practical penetration testing techniques
- glusterfs ctdb integration
- 2 08 democracy suite imagecast central system
- installing and configuring splunk on red hat enterprise
- i n s t a l l l a t e s t acoustic toolbox
Related searches
- using technology in the classroom
- using this in java
- using choose in a sentence
- instead of using i in an essay
- using minecraft in education
- benefits of using technology in the classroom
- using but in a sentence
- using we in an essay
- not using you in writing
- using names in a sentence
- using you in an essay
- using citations in a paper