- Lab
-
Libraries: If you want this lab, consider one of these libraries.
- Cloud
- Security
Incident Investigation in AWS
In this hands-on lab, you’ll investigate a suspected compromise of an EC2 instance and apply incident response procedures using AWS-native services. You’ll learn to analyze GuardDuty findings, isolate the affected resource with Security Groups, and automate forensic snapshots of future SSH brute force using AWS Lambda. You’ll also preserve collected evidence in an S3 bucket, then complete an incident report documenting your actions. These skills are essential for responding to real-world incidents in AWS and conducting effective investigations.
Lab Info
Table of Contents
-
Challenge
Contain and isolate the compromised EC2 instance
Apply containment procedures that stop lateral movement and data exfiltration from the compromised EC2 instance. This is done by isolating the instance with Security Groups and replacing its current Security Group with the "Quarantine" Security Group. The quarantine prevents attackers from moving across your environment or stealing sensitive data.
-
Challenge
Automate future forensic EBS volume snapshots using AWS Lambda
You’ll explore how to automate forensic evidence collection by creating snapshots of the EBS volume attached to a compromised EC2 instance whenever GuardDuty detects an SSH brute force attack. This automation ensures critical forensic data is preserved at the moment of compromise, reducing the risk of data loss and enabling thorough post-incident analysis.
-
Challenge
Capture and export logs from the compromised EC2 instance
You’ll need to capture the journalctl logs from the compromised EC2 instance, securely copy them to the quarantinebucket S3 bucket, and then search the journalctl.log file for SSH activity.
Preserving these logs provides critical forensic evidence, maintains integrity for post-incident reviews, and supports compliance with audit and legal requirements.
-
Challenge
Document actions taken in an incident report
Finally, summarize the incident response actions taken, and to be taken, by creating an incident report. Clear documentation ensures stakeholders understand the incident’s scope, the effectiveness of the response, and lessons learned to strengthen future defenses.
Real skill practice before real-world application
Hands-on Labs are real environments created by industry experts to help you learn. These environments help you gain knowledge and experience, practice without compromising your system, test without risk, destroy without fear, and let you learn from your mistakes. Hands-on Labs: practice your skills before delivering in the real world.
Learn by doing
Engage hands-on with the tools and technologies you’re learning. You pick the skill, we provide the credentials and environment.
Follow your guide
All labs have detailed instructions and objectives, guiding you through the learning process and ensuring you understand every step.
Turn time into mastery
On average, you retain 75% more of your learning if you take time to practice. Hands-on labs set you up for success to make those skills stick.