The AWS Detective Forensics & Incident Response talk will focus on the benefits of using AWS Detective for forensic analysis and incident response. The talk will provide an overview of AWS Detective and its capabilities, including how it can help investigate security incidents and provide visual representations of the investigation results. The talk will also cover key considerations and best practices for implementing effective incident response processes using AWS Detective, such as setting up AWS Detective and integrating it with other AWS services. Additionally, the talk will delve into the importance of forensic analysis in identifying the root cause of security incidents and how AWS Detective can help perform effective forensic investigations. The talk will also include examples of how AWS Detective has been used to detect and remediate security incidents in real-world scenarios, and best practices for using AWS Detective to improve overall security posture.

1. AWS Detective
Forensics & Incident
Response
Cado Security | 1

2. What is AWS Detective?

3. What are Example Use Cases?
https://pages.awscloud.com/rs/112-TZM-766/images/2020_0122-SID_Slide-Deck.pdf

4. What are Investigation Playbooks?
https://maturitymodel.security.aws.dev/en/4.-optimized/detective/

5. How do you Search?
https://aws.amazon.com/blogs/aws/amazon-detective-rapid-security-investigation-and-analysis/

6. How do you review a Guard Duty Finding?
https://aws.amazon.com/blogs/aws/amazon-detective-rapid-security-investigation-and-analysis/

7. How do you review Connections?
https://aws.amazon.com/blogs/aws/amazon-detective-rapid-security-investigation-and-analysis/

8. How do you analyze detailed
VPC Flow Logs?
https://aws.amazon.com/blogs/security/investigate-vpc-flow-with-amazon-detective/

9. How do you use GeoIP?
https://aws.amazon.com/blogs/aws/amazon-detective-rapid-security-investigation-and-analysis/

10. Cado Response
Free 14-day trial
Receive unlimited access to
the Cado Response Platform
for 14 days.
www.cadosecurity.com/free-investigation/