A public incident response process documentation used at PagerDuty
This project explores useful CloudTrail events that support incident response and detection of misconfigurations. Documenting the queries and filters used to identify these CloudTrail events helps to: * build a timeline of events * understand the scope of the incident * identify indicators of compromise * decrease time to containment and recovery Mis-configurations are important events to identify early. These configurations may introduce a vulnerability, but may also be an indicator of compromise. Whether executed manually or by automating, this information may be used to develop incident response playbooks. These types of formalization activities promote a consistent, efficient, and effective response to security incidents.
A public incident response process documentation used at PagerDuty
Tool to bypass endpoint solutions blocking known 'malicious' signed applications by obtaining valid signed files with different hashes.
Web-based tool for incident response with easy local installation using Docker.
Fast Intercept is a security automation platform that empowers users to maximize their existing security products and automate routine tasks.
Repository of templates for Ayehu's workflows with the ability to design, execute, and automate IT and business processes.
DFIRTrack is an open source web application focused on incident response for handling major incidents with many affected systems, tracking system status, tasks, and artifacts.