DFIR Evidence Collection and Preservation for the Cloud
summary
M365 Unified Audit Log is often off for tenants created before October 2021 and needs the get-admin-auditlog-config checks; Azure AD auth logs are retained 30 days by default, Azure tenant/subscription logs are on ~90 days while resource and flow logs are off by default; AWS CloudTrail keeps control‑plane events 90 days and data‑plane/flow logs must be enabled per resource; Google Workspace keeps many logs six months and can export to Google Cloud; Google Cloud keeps core audit logs 400 days; use API/PowerShell and tools like SOF-ELK for bulk collection and central analysis.
AI-written summary · about
chapters (12)
- 0:00Introduction and speakers
- 2:48Cloud forensics vs traditional methods
- 8:55Microsoft 365 log collection
- 15:46Google Workspace evidence handling
- 27:29Azure infrastructure logs
- 32:29AWS log sources and collection
- 39:59Google Cloud log retention and types
- 45:46Tools and resources for log analysis
- 47:53Q&A session part 1
- 51:04Q&A session part 2
- 54:37Q&A session part 3
- 1:01:26Q&A session part 4
related talks
50mOptimizing audits with automation
29mCloud compliance and assurance
46mLearning security monitoring through failure
40mMulti-Cloud Anomaly Detection: Finding Threats Among Us in the Big 3 Clouds
25mLogging, Monitoring, and Alerting in AWS (The TL;DR)
19mA close look at compliance with AWS Cloud Audit Academy
10mLightning Talk: Challenges in Cloud Native Forensics
32mContinuously assess controls for risk and compliance