Back to Course

Incident Response with CloudTrail and Athena

0% Complete
0/0 Steps

  1. Introduction

    Start here!
  2. About the course
  3. Important! Use a separate AWS account for this course
  4. Optional but helpful tools
  5. [LAB] Enable budget alerting
  6. Preparing your AWS account
    The roles we need
  7. Enable IAM Identity Center
  8. Creating the SecurityAnalyst role
  9. Assuming roles created through Identity Center
  10. Creating remaining roles
  11. Incident Response with CloudTrail Lake
    Playbook - Compromised IAM access key
  12. Configuring CloudTrail Lake
  13. Deploying lab resources
  14. Simulating an attack - S3 backdoor and data exfil
  15. Analysis - Validate
  16. Containment - Access Key
  17. Analysis - Scope
  18. Containment - User and S3 Bucket
  19. Analysis - Impact
  20. Eradication
  21. Recovery
  22. Post-incident activity
  23. Response Steps & Complete Playbook (Recap)
  24. Cleaning up
  25. Incident Response with Athena
    Playbook - Cryptocurrency mining
  26. Updating our permission sets
  27. Configuring our AWS environment
  28. Simulating an attack
  29. Analysis - Validate
  30. Containment - User & Access Key
  31. About Athena
  32. Configuring Athena
  33. Analysis - Scope - Part 1
  34. Analysis - Scope - Part 2
  35. Analysis - Scope - Part 3
  36. Containment - Backdoor User
  37. Containment - Instances
  38. Analysis - EC2 Forensics
  39. Analysis - Impact
  40. Eradication
  41. Recovery
  42. Post-incident activity
  43. Response Steps & Complete Playbook (Recap)
  44. Cleaning up
  45. Incident Response for multi-account
    Multi-account architecture for security logging
  46. Deploying roles for multi-account IR
  47. Multi-account CloudTrail deployment
  48. Enable centralized CloudTrail Lake Event Data Stores and Queries
  49. About deploying with IaC
  50. Conclusion
    What now?
Lesson 51 of 50
In Progress

Preparation

Christophe January 24, 2024

Responses

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Report

Harassment or bullying behavior
Contains mature or sensitive content
Contains misleading or false information
Contains abusive or derogatory content
Contains spam, fake content or potential malware

Block Member?

Please confirm you want to block this member.

You will no longer be able to:

  • See blocked member's posts
  • Mention this member in posts

Please allow a few minutes for this process to complete.

Report

You have already reported this .