Container Investigations Cheat Sheet

Distroless containers, whilst reducing the attack surface and improving performance, present significant visibility challenges due to their lack of standard utilities and monitoring tools.

This playbook covers best practices for securing and investigating containerized applications running in Amazon Elastic Container Service (ECS). 

Containerization has changed the way organizations develop and deploy applications. However, the same benefits that make containers attractive, their ephemeral and layered nature, also present unique challenges for Digital Forensics and Incident Response (DFIR) teams.