• Labs
    • Learning Paths
    • CybrBits
    • All Courses
    • Join Discord
    • Contact & Support
    • Blog
    • Cheat Sheets
    • Ebooks
    • Podcasts
    • Webinars
  • Pricing
    • Training
    • Hosted Labs
    • Consulting
Sign in Sign up
Incident Response with CloudTrail and Athena

6 sections · 50 lessons

  • Video
  • Reading
  • Premium
  1. 1 Introduction
    1. Reading: Start here! Preview
    2. Reading: About the course Preview
    3. Reading: Important! Use a separate AWS account for this course Preview
    4. Reading: Optional but helpful tools Preview
    5. Reading: [LAB] Enable budget alerting Preview
  2. 2 Preparing your AWS account
    1. Video: The roles we need Preview
    2. Video: Enable IAM Identity Center Preview
    3. Video: Creating the SecurityAnalyst role Preview
    4. Video: Assuming roles created through Identity Center Premium
    5. Video: Creating remaining roles Premium
  3. 3 Incident Response with CloudTrail Lake
    1. Video: Playbook - Compromised IAM access key Premium
    2. Video: Configuring CloudTrail Lake Premium
    3. Video: Deploying lab resources Premium
    4. Video: Simulating an attack - S3 backdoor and data exfil Premium
    5. Video: Analysis - Validate Premium
    6. Video: Containment - Access Key Premium
    7. Video: Analysis - Scope Premium
    8. Video: Containment - User and S3 Bucket Premium
    9. Video: Analysis - Impact Premium
    10. Video: Eradication Premium
    11. Video: Recovery Premium
    12. Video: Post-incident activity Premium
    13. Reading: Response Steps & Complete Playbook (Recap) Premium
    14. Video: Cleaning up Premium
  4. 4 Incident Response with Athena
    1. Video: Playbook - Cryptocurrency mining Premium
    2. Video: Updating our permission sets Premium
    3. Video: Configuring our AWS environment Premium
    4. Video: Simulating an attack Premium
    5. Video: Analysis - Validate Premium
    6. Video: Containment - User & Access Key Premium
    7. Video: About Athena Premium
    8. Video: Configuring Athena Premium
    9. Video: Analysis - Scope - Part 1 Premium
    10. Video: Analysis - Scope - Part 2 Premium
    11. Video: Analysis - Scope - Part 3 Premium
    12. Video: Containment - Backdoor User Premium
    13. Video: Containment - Instances Premium
    14. Reading: Analysis - EC2 Forensics Premium
    15. Video: Analysis - Impact Premium
    16. Video: Eradication Premium
    17. Video: Recovery Premium
    18. Video: Post-incident activity Premium
    19. Reading: Response Steps & Complete Playbook (Recap) Premium
    20. Video: Cleaning up Premium
  5. 5 Incident Response for multi-account
    1. Video: Multi-account architecture for security logging Premium
    2. Video: Deploying roles for multi-account IR Premium
    3. Video: Multi-account CloudTrail deployment Premium
    4. Video: Enable centralized CloudTrail Lake Event Data Stores and Queries Premium
    5. Reading: About deploying with IaC Premium
  6. 6 Conclusion
    1. Reading: What now? Premium

Section 5 · Incident Response for multi-account

Enable centralized CloudTrail Lake Event Data Stores and Queries

Christophe Limpalair

Christophe Limpalair

Premium

This lesson is part of a Premium course

Join Premium to open it, along with every course, practice exam and hands-on lab on Cybr.

View Plans Already a member? Sign in
  • Video lessons with full transcripts
  • Hands-on labs in real cloud accounts
  • Practice exams with explanations
PreviousMulti-account CloudTrail deployment
Next About deploying with IaC