Dredge: An Open Source Framework For Cloud Incident Response

The talk starts from a pattern seen often at small and mid-sized companies in Argentina and Latin America. Many organisations skip incident response preparation, so they either tune detection rules until alerts are ignored or run with no useful logs at all. When an attack hits, they have no record of their infrastructure, and commercial logging and monitoring products are expensive and slow to deploy. Skilled cloud responders are also scarce and costly.

The speaker presents Dredge, an open-source set of scripts organised into four modules: log retrieval, threat hunting, incident response and a cloud posture check. The posture module is aimed at responders rather than auditors, listing the details needed during an incident, such as IAM users with access keys, MFA status and console access, and resource creation times that can reveal persistence. The log retriever pulls GitHub enterprise audit events that the web console does not show, and pulls AWS data across several accounts using one configuration file with a chosen time window. The isolation demo covers a compromised EC2 instance. It swaps the security group, adds a network ACL to cut existing connections and moves the host into a forensic group, with a warning that network ACLs affect the whole subnet.

For threat hunting, the tool enriches IP addresses and files through Shodan, WHOIS and VirusTotal, and searches AWS event history by IP, user agent or persistence API calls. The speaker notes that event history keeps about three months of records even after trails are disabled. The closing example flags disabled CloudTrail logging and deleted GuardDuty detectors. The main takeaways are to keep logs, document infrastructure before an incident, and treat the tool as a tactical aid rather than a full hunting platform. Gaps remain, including GCP response and posture checks, and the speaker invited contributions.