Automated incident response and forensic analysis on AWS - part 2
Channel: Matthieu LIENART
Date: 2020-03-08

In this episode I an demoing a fully automated security incident response, forensic analysis and web application auto-healing on AWS using a StepFunctions and Lambda functions.

In this video, I am first presenting the StepFunction and Lambda functions which perform the security incident response and forensic.
I then perform a demo of the full automation by remotely compromising on of the application's EC2 instance.

All the CloudFormation templates and code are available on the GitHub repo: https://github.com/mlnrt/incident-response-and-forensic

 Credits:
- This demo is primarily based on the demo released by Ben Potter at AWS Summit London 2018: https://www.youtube.com/watch?v=f_EcwmmXkXk
The code of his demo is available here : https://github.com/awslabs/aws-security-automation/tree/master/EC2%20Auto%20Clean%20Room%20Forensics
- I also reused and modified a VPC CloudFormation template released by Levon Becker for Stelligent available here: https://github.com/stelligent/cloudformation_templates/blob/master/infrastructure/vpc.yml
- I also reused shell scripts published by Ryan Holland and Oliver Cahagne on AWS Labs to simulate security breaches to test GuardDuty: https://github.com/awslabs/amazon-guardduty-tester/blob/master/guardduty_tester.sh