View a markdown version of this page

Usage of Forensic Guidance - Automated Forensics Orchestrator for Amazon EC2 and EKS
Step 1. Sign in to the Security Hub AWS Account AWS Management Console and initiate forensic analysisStep 2. Sign in to the Forensic AWS Account AWS Management Console and view step functions flow

Usage of Forensic Guidance

Step 1. Sign in to the Security Hub AWS Account AWS Management Console and initiate forensic analysis

After the Guidance CloudFormation stack has been deployed and launched, you can sign in to the web interface.

  1. Sign in to the AWS Security Hub console.

  2. To display a finding list, do one of the following:

    1. In the Security Hub navigation pane, choose Findings.

    2. In the Security Hub navigation pane, choose Insights. Select an insight, and then on the results list, select an insight result.

    3. In the Security Hub navigation pane, choose Integrations. Choose See findings for an integration.

  3. Select the finding title.

  4. Select the instance findings to trigger forensics.

  5. In Actions , you can select:

    1. Forensic Isolation to initiate forensic analysis and perform isolation of instance.

    2. Forensic Triage to initiate forensic analysis.

      Forensic analysis - Actions

      initiate forensic analysis

Step 2. Sign in to the Forensic AWS Account AWS Management Console and view step functions flow

  1. Sign in to the AWS Step Functions console.

  2. After completion of triaging, an acquisition and investigation flow email will be sent to subscribed SNS topic.

    Acquisition and investigation flow notification

    image::images/investigation-flow-sns.png[scaledwidth=100%]. Check email for details of the forensic results.

    Example Disk Analysis result:

    Example - Disk Analysis result

    image::images/disk-analysis-result.png[scaledwidth=100%]+

Example Memory Analysis result:

+ .Example - Memory Analysis result image::images/memory-analysis-result.png[scaledwidth=100%]