Troubleshooting

This section provides troubleshooting instructions for deploying and using the Guidance.

Zero-byte files reported as part of memory and disk investigation

Issue : The memory analysis and disk analysis results in S3 could result in zero-byte files.

Troubleshooting - zero-byte files

This could be a problem with the Volatility symbol table. Review the symbol table associated with the instance as well as the error logs in the Run Command history.

Troubleshooting - Run Command history

Resolution : This is caused due to an error in SSM document run. Review the SSM error to fix the SSM document. It is necessary to review the Volatility symbol table and kernel version to ensure it matches the kernel version of running on the compromised EC2 instance.

ForensicSecHubStack failed to deploy

Issue : ForensicSecHubStack failed to deploy. Received response status [FAILED] from custom resource. Message returned: InvalidAccessException: An error occurred (InvalidAccessException) when calling the CreateActionTarget operation: Account <Account> is not subscribed to AWS Security Hub. See details in CloudWatch Log Stream.

Resolution : Activate Security Hub and redeploy ForensicSecHubStack.