CSI Container: Can You DFIR It?
summary
Runtime DFIR for Kubernetes environments explains concrete steps and tools: use Falco alerts and Prometheus metrics to spot suspicious wget and spawned shells, label and apply NetworkPolicy to isolate the pod, then immediately snapshot the worker node volume and commit and push the impacted container image or create a container checkpoint (works well with podman) for offline analysis; also check service account tokens, privileged mounts and lateral movement to hosts before eradication and recovery.
AI-written summary · about
chapters (8)
- 0:00Start
- 8:10DFIR in containers
- 10:00Preparation
- 14:25Detection and Analysis
- 18:32Containment, Eradication, and Recovery
- 23:56Demo - Live approach
- 29:01Container Checkpoint - Podman
- 34:42Main Takeaways
related talks
37mCSI Forensics: Unraveling Kubernetes Crime Scenes
34mContainer Forensics: What to Do When Your Cluster is a Cluster
29mContainer Forensics for Kubernetes: Building an Evidence Pipeline With Open Source…
50mRuntime Security for Containers
29mDetection Engineering in Kubernetes Environments: Wrangling Security Data Out of You...
43mWTF, My Container Just Spawned a Shell
43m6 Strategies to Bring Order to Kubernetes Security Disruptions
33mFIND, FOCUS, and FIX the Container and Cloud Threats that Matter