Incident response guide for AWS CloudTrail investigations – Part 2
We also introduced key incident response terminology and investigative frameworks for analyzing AWS CloudTrail events.
Useful takeaways from this story.
We also introduced key incident response terminology and investigative frameworks for analyzing AWS CloudTrail events.
In Part 1 of this guide, we examined two common incident scenarios: cross-account Amazon Simple Storage Service (Amazon S3) data deletion with ransomware implications, and cryptocurrency mining deployed...
Building the complete brief
The page is ready to read now. The fuller skim-friendly version will appear here automatically.
The useful part
We also introduced key incident response terminology and investigative frameworks for analyzing AWS CloudTrail events. In Part 1 of this guide, we examined two common incident scenarios: cross-account Amazon Simple Storage Service (Amazon S3) data deletion with ransomware implications, and cryptocurrency mining deployed through AWS CloudFormation using exposed AWS Management Console credentials.
How it works
- In Part 1 of this guide, we examined two common incident scenarios: cross-account Amazon Simple Storage Service (Amazon S3) data deletion with ransomware implications, and cryptocurrency mining deployed...
Keep reading in the app
Open the app view to save this story, compare related coverage, and continue from the same source.