Incident Response with CloudTrail and Athena
Learn how to effectively respond to incidents in your AWS accounts regardless of whether you are running a single or multi-account setup using CloudTrail Lake and Athena — two native AWS services.
This Incident Response (IR) course simulates attacks against your AWS environments that have been seen in the real-world. After simulating attacks, you’ll put on your security analyst hat to respond to the incident. You will then learn how to follow IR playbooks from AWS and eventually even create your own by following NIST’s 4 phases:
- Preparation
- Detection and Analysis
- Containment, Eradication, and Recovery
- Post-Incident Activity
You’ll learn how to gather information to understand what’s going on and what resources are involved, and how to properly contain the affected resources. You will then take steps to eradicate the threat, recover (and harden) your configurations, and put together a report that you can turn into an updated playbook specific to your environments and use cases.
The attack scenarios and end-to-end projects include:
- IAM credentials exposure to S3 backdoor and data exfiltration
- IAM credentials exposure to EC2 cryptomining
The final section of the course then shows you how to take what you’ve learned and apply it to multi-account setups with centralized CloudTrail logging in a Log Archive account, and centralized IR querying with CloudTrail Lake in a Security Tooling account.
Who is it for?
🔵 Anyone interested in learning about AWS Incident Response (IR). You will pick up new skills that can be applied directly on the job for both security and operational troubleshooting purposes.
🔴 This course will also help red teamers since it will show how your actions get logged and can be used in investigations. Understanding that is critical to reducing your footprint and avoiding detection.
What will you learn?
- How to enable Identity Center for user and role management
- How to configure and use CloudTrail Lake for IR
- How to craft SQL queries to find the information you need
- How to configure and use Athena for IR
- How to write & use scripts to simulate attacks and test defenses
What makes this course different
🛠️ Hands-On and Practical: This course has very little theory and a whole lot of practical. Get ready to learn by deploying resources, configuring those resources, simulating attacks, and running queries to get to the bottom of an incident.
💎 Production quality: We’ve been developing cloud and security training material for over 8 years and have taught hundreds of thousands of IT professionals all the way from individuals to Fortune 500 companies. Our production quality is top-notch and not only reflects expert experience but focuses on building practical skills.
Recommended Pre-Requisites
About the Author
This course was created, developed, and published by Christophe Limpalair. Christophe is the founder and an author at Cybr, where he’s published many courses on topics of ethical hacking. Over the past 8 years, Christophe has taught multiple AWS courses including associate and professional-level AWS certification courses, and helped tens of thousands of learners get certified and build practical skills. He also helped pioneer, develop, maintain, and secure Linux Academy’s Hands-On Labs and Assessments technology which ran as a $1m+ budget on AWS, and which has since become the lab platform used by Pluralsight through an acquisition. He shares his AWS security expertise in this course to help you get started learning how to secure your own AWS resources and environments.
Course Content
Introduction
About Instructor
Course Includes
- 50 Lessons
- Course Certificate