SOC Forensics: How to Set Up Automatic DFIR Analysis in the Cloud
Brief
SOC analysts need the best data available to make decisions about alerts, and that often involves collecting endpoint artifacts. I’m going to show how to get artifacts collected and analyzed with minimal effort using cloud infrastructure.
The cloud-based process can happen while the analyst is reviewing telemetry:
- Artifacts are uploaded to cloud storage (S3 or Azure blob).
- A cloud function (Lambda, functions, etc.) will be triggered and start the analysis.
- The results will be ready when the telemetry review is complete.
Why Telemetry Alone Isn’t Enough
EDR telemetry and the SIEM are often the first places analysts look for evidence of an intrusion. EDR telemetry is great, but there may not be telemetry if:
- The attacker disabled the EDR agent. For example, EDR Silencer will cause data to not be sent to the EDR server. There are many other similar tools.