ssm-acquire
A Python module for orchestrating remote forensic data acquisition and analysis from Linux instances using Amazon SSM.

ssm-acquire
A Python module for orchestrating remote forensic data acquisition and analysis from Linux instances using Amazon SSM.
ssm-acquire Description
ssm-acquire is a Python module that orchestrates content acquisitions and analysis through Amazon Systems Manager (SSM). The tool enables remote forensic data collection from Linux instances running the Amazon SSM Agent. Key capabilities include: - Memory acquisition from Linux instances directly to S3 buckets using SSM - Instance interrogation for top-10 indicators of compromise (IOCs) using OSQuery - Memory sample analysis on target machines using Docker containers - Rekall profile creation using instances as build targets The module leverages Amazon's SSM infrastructure to perform remote forensic operations without requiring direct access to target systems. It supports automated workflows for memory dumping, IOC detection, and forensic analysis in cloud environments. ssm-acquire is distributed as free software under the MPL 2.0 License and is currently in pre-release status. Documentation is available at https://ssm-acquire.readthedocs.io.
ssm-acquire FAQ
Common questions about ssm-acquire including features, pricing, alternatives, and user reviews.
ssm-acquire is A Python module for orchestrating remote forensic data acquisition and analysis from Linux instances using Amazon SSM.. It is a Security Operations solution designed to help security teams with Cloud Forensics, SSM, S3.
ALTERNATIVES
A deprecated digital forensics tool by Netflix that helped investigators scope compromises across AWS cloud instances by identifying behavioral differences and outliers during security incidents.
BinaryAlert is an open-source serverless AWS pipeline that automatically scans files uploaded to S3 buckets with YARA rules and generates immediate alerts when malware is detected.
A forensics toolkit for collecting digital evidence from Google Cloud Platform, Microsoft Azure, and Amazon Web Services during incident response investigations.
POPULAR
TRENDING CATEGORIES
Stay Updated with Mandos Brief
Get strategic cybersecurity insights in your inbox