AWS Incident Response Investigation of API activity using Athena and notification of actions using EventBridge Logo

AWS Incident Response Investigation of API activity using Athena and notification of actions using EventBridge

0
Free
Visit Website

This project explores useful CloudTrail events that support incident response and detection of misconfigurations. Documenting the queries and filters used to identify these CloudTrail events helps to: * build a timeline of events * understand the scope of the incident * identify indicators of compromise * decrease time to containment and recovery Mis-configurations are important events to identify early. These configurations may introduce a vulnerability, but may also be an indicator of compromise. Whether executed manually or by automating, this information may be used to develop incident response playbooks. These types of formalization activities promote a consistent, efficient, and effective response to security incidents.

FEATURES

ALTERNATIVES

TheHive is a case management platform for security operations teams that facilitates incident response, threat analysis, and team collaboration.

jimi is an orchestration automation tool for multi-team collaboration and automation in IT/Security operations, Development, and CI/CD pipelines.

Detailed analysis of the event-stream incident and actions taken by npm Security.

Scripts to quickly fix security and compliance issues

Malware allows attackers to execute Windows commands from a remote environment

PlexTrac is a centralized platform for penetration test reporting and threat exposure management that helps security teams streamline assessment workflows, prioritize remediation, and track security posture improvements.

Templates for incident response run-books tailored for AWS environments based on NIST guidelines.

Sample security playbooks for security automation, orchestration and response (SOAR) using Microsoft Sentinel trigger

PINNED