Incident Response in Docker, Kubernetes and Amazon EKS Environments

Looking for a weekend DFIR read? We've released a free whitepaper on responding to attacks in Docker, Kubernetes and AWS EKS environments.

You can get the full whitepaper on our website - but a few highlights are below.

Check out the docker logs, typically under /var/lib/containers/*id*/*id-json.log to see records of containers spinning up and down:

There are a bunch of different possible file systems for Docker/Kubernetes - but these days it's most likely going to be overlay2 - which is pretty easy to browse:

For EKS - Amazon stores a ton of information in S3 - if enabled. It's a slightly odd mix of JSON, CSV often compressed into .gz. You can parse and alert/investigate on them.