Automated Triage Collection at Scale in the AWS Cloud
Channel: BSidesDFW
Date: 11/11/2021

BSidesDFW 2021 Track 2 Session 4 - 06 Nov 2021

Automated Triage Collection at Scale in the AWS Cloud

During a cybersecurity incident, answers are needed quickly. This generally starts with an incident responder performing a triage collection to pull back targeted host-based artifacts for analysis. Manual workflows to perform this triage collection are not only time consuming but also prone to human error and inefficient. This talk will discuss an event-driven workflow to perform these triage collections at scale in the AWS cloud. It leverages AWS Systems Manager (SSM) to perform triage collections from Windows and Linux EC2 instances and can accommodate EC2-backed containers as well. This solution is easily customizable and will output triage collection packages to S3 that can be tailored to fit a company's IR standard operating procedures.

Ryan Tick is Manager for KPMG based out of Dallas, where he helps clients in the areas of DFIR and cloud IR automation in AWS. Prior to KPMG, he was a senior cloud engineer for Goldman Sachs, responsible for securing their footprint in the AWS cloud. Ryan previously presented at a variety of conferences, including AWS re:Invent and fwd:cloudsec. He is 4x SANS certified and 5x AWS certified.