search

aws-solutions / automated-forensic-orchestrator-for-amazon-ec2

Automated Forensics Orchestrator for Amazon EC2 is a self-service AWS Solution implementation that enterprise customers can deploy to quickly set up and configure an automated orchestration workflow that enables their Security Operations Centre (SOC) to capture and examine data from EC2 instances and attached volumes as evidence for forensic analysis, in the event of a potential security breach. It will orchestrate the forensics process from the point at which a threat is first detected, enable isolation of the affected EC2 instances and data volumes, capture memory and disk images to secure storage, and trigger automated actions or tools for investigation and analysis of such artefacts. All the while, the solution will notify and report on its progress, status, and findings. It will enable SOC to continuously discover and analyze patterns of fraudulent activities across multi-account and multi-region environments. The solution will leverage native AWS services and be underpinned by a highly available, resilient, and serverless architecture, security, and operational monitoring features. Digital forensics is a 4 step process of triaging, acquisition, analysis and reporting. Automated Forensics framework provides capability to enterprise to act on security event by imaging or acquisition of breached resource for examination and generate forensic report about the security breach. In the event of a security breach, it will enable customers to easily to capture and examine required targeted data for forsensic’s storage and analysis. This solution framework enables security operations centre to discover and analyse patterns of fraudulent activities. The automated forensics solution will provide a multi-account and a multi-region [“solution”] built using native AWS services.
Apache License 2.0
58 stars 9 forks source link

Fo-triage lambda is failing on not able to accuire instance detail info #20

Open reshmaks opened 11 months ago

reshmaks commented 11 months ago

Describe the bug Get Instance Lambda function assumes role into compromised application account and is unable to retrieves instance information.

To Reproduce

AWS Security Hub operating in AWS application account is reported with details of the compromised instance and the findings get aggregated to AWS Security Hub administrator AWS master Account.

The security administrator initiates one of the following forensic actions in Security Hub.

Forensic triage

Forensic isolation

Amazon EventBridge initiates the triage Step Functions flow.

Expected behavior A clear and concise description of what you expected to happen.

Please complete the following information about the solution:

To get the version of the solution, you can look at the description of the created CloudFormation stack. For example, "(SO0191) - Automated Forensics for Amazon EC2. Version v5.0.0". If the description does not contain the version information, you can look at the mappings section of the template:

Mappings:
    SourceCode:
        General:
            S3Bucket: 'solutions'
            KeyPrefix: 'automated-forensics-for-amazon-ec2/v1.0.0'

Screenshots

Screenshot 2023-12-14 at 1 50 49 PM

Additional context Add any other context about the problem here.

dadmukta commented 3 months ago

Thanks for reporting the issue. We are investigating this.

bios6 commented 4 days ago

Hi @reshmaks,

Can you provide more information like the version of the solution you are using and region's you are working with? Any other information you can provide will be helpful (like if the solution was modified) and you might be able to check CloudTrail to find more information. We will also suggest using the latest version of the solution.

Thanks!