Open Source DFIR

Overview As digital threats continue to grow, organizations need to be able to respond quickly and effectively to security incidents. One critical component of incident response is having the right set of tools at hand to analyze and respond to threats. However, manually deploying and integrating multiple open source DFIR tools can be a time-consuming and error-prone process, causing significant delays in incident response times, which can lead to a higher risk of damage to the organization. To address this challenge, we are excited to share an open source repository for deploying and managing Open Source Digital Forensics & Incident Response (OSDFIR) tools in Kubernetes . OSDFIR Infrastructure automates the tedious deployment and configuration steps, removing the manual labor involved in setting up and maintaining an enterprise DFIR Infrastructure in Kubernetes.  Using this has helped save hours of time by reducing the time required to deploy, configure, and maintain each too...

As containerized applications have gained popularity and are the most common method for deploying applications in the cloud, digital forensics analysts need to be familiar with the process and tools to examine the containers.  A previous blog post Container Forensics with Docker Explorer dives into details on analyzing a compromised container with an open source tool Docker Explorer .  This article focuses on analysis of Google Kubernetes Engine (GKE) containers running containerd and the process and open source tools that would aid in forensic analysis of a potential compromised container. The research work for this article was conducted using a GKE cluster. In this article, the commands starting with gcloud are Google Cloud Platform (GCP) specific commands, and kubectl commands are Kubenetes commands that are the same for all cloud providers. In our investigation, we received signals indicating scanning activity towards the web server running on a GKE cluster. All we know...