Container Forensics: What to Do When Your Cluster is a Cluster
summary
Covers where to collect forensic evidence in Kubernetes clusters: centralized logs (infrastructure, k8s audit, OS, app) sent to stackdriver or elasticsearch via fluent e, snapshots of node disks analyzed with docker Explorer, live memory and syscall captures via Gurr and Cystic for dead containers, and detection rules with Falco. Recommends concrete mitigations ranked by severity—alert, isolate (reschedule node + network policy), docker pause, restart with a fixed image, or kill—and rehearsing an incident response plan.
AI-written summary · about
chapters (14)
- 0:00Intro
- 0:40Threats seen in the wild
- 2:20Incident preparedness
- 2:54Don't Panic
- 7:26Infrastructure logs
- 8:23Kubernetes logs
- 11:33Application logs
- 12:04Collecting all the logs
- 13:16Snapshot the node
- 13:54docker-explorer
- 16:13Sysdig Inspect & Capture
- 23:24Privilege escalation
- 23:42Gather some evidence
- 27:05Tying it all together mitigation options
related talks
29mContainer Forensics for Kubernetes: Building an Evidence Pipeline With Open Source…
37mCSI Forensics: Unraveling Kubernetes Crime Scenes
39mCSI Container: Can You DFIR It?
29mDetection Engineering in Kubernetes Environments: Wrangling Security Data Out of You...
30mEffective Detection in Kubernetes Clusters
10mLightning Talk: Challenges in Cloud Native Forensics
01h 24mTutorial: Attacking and Defending Kube...
43m6 Strategies to Bring Order to Kubernetes Security Disruptions