Automated Forensics Orchestrator for Amazon EC2

Capture and examine data from EC2 instances and attached volumes for forensic analysis

Overview

Automated Forensics Orchestrator for Amazon EC2 deploys a mechanism that uses AWS services to orchestrate and automate key digital forensics processes and activities for Amazon Elastic Compute Cloud (Amazon EC2) instances in the event of a potential security issue being detected.

This AWS Solution helps to establish an automated workflow across data acquisition from disk and memory, instance isolation, and invocation of third-party forensics investigation, analysis, and reporting tools that can be easily integrated with the solution. The solution is intended for organizations deploying and running workloads on EC2 instances and aims to support their security operations and response functions.

Note: We make no claim as to the suitability of Automated Forensics Orchestrator for Amazon EC2 in the detection or investigation of crime, nor the ability of data or forensics evidence captured by this solution to be used in a court of law. You should independently evaluate the suitability of Automated Forensics Orchestrator for Amazon EC2 for your use case.

Benefits

Automate manual, time-consuming digital forensics tasks

Quickly establish an end-to-end, in-house, and low touch digital forensics capability that automatically orchestrates data acquisition from disk and memory, instance isolation, and invocation of forensics investigation and analysis tools.

Respond faster, at scale

Scale your digital forensics automation across fleets of AWS Systems Manager-managed EC2 instances and automatically initiate acquisition and isolation processes for tagged EC2 instances in multiple accounts or across Regions. Reduce mean time to acquire and process evidence from the point of detection—down to minutes.

Plug in open-source or third-party forensics tooling

Get started with out-of-the-box support for Amazon Linux 2 and Sans SIFT open-source tools, such as log2timeline, Volatility 2, and LiME. Customize and extend the solution for specific OS kernels, or your preferred forensics tools, using Systems Manager documents.

Set up end-to-end traceability

Monitor your end-to-end forensic orchestration workflow and processes with correlation identifiers. Keep your security operations personnel informed of progress through regular and timely notifications.

Technical details

You can automatically deploy this architecture using the implementation guide.

Use cases for this AWS Solution
  • Headline
More…
About this deployment
  • Publish Date
Deployment options
Ready to get started?

Note: Before you launch the solution in the AWS Management Console, ensure that you meet the prerequisites in the implementation guide.

Was this page helpful?