Easy-bake IR - Automated incident response using the power of APIs

The talk opens with the chaos of a breach where every team has a different theory and existing controls have missed the early stages of the attack. The speaker recommends working backwards from the data that is still available, and stresses preserving volatile evidence before anyone reboots, rebuilds or patches systems. He compares the SANS PICERL and NIST incident response lifecycles, noting that investigation and containment often loop back on each other, and points to breach reports and threat trend studies as sources for planning.

The middle of the talk follows a fictional case involving a recently acquired business unit. A breach-exposure lookup of employee addresses points to one user with a history of phishing failures. The mailbox export is hashed and logged to a verifiable evidence store, then parsed for sender domain reputation, domain registration age, URLs, IP reputation and password-reset keywords. An interview with the user, combined with CloudTrail events pulled through the AWS API, reveals a changed database master password, many new access keys and logins through a suspicious VPN. Apache Tika then extracts text from attachments so a redaction engine can count personal identifiers such as Social Security numbers, and the malicious indicators are uploaded to an EDR platform through its API.

The takeaway is that a notebook of reusable scripts can shorten triage and leave a documented evidence trail, provided responsibilities are separated between requesting, approving and analysing data. Responders should involve HR and legal early, account for regional rules on employee data, and avoid partial investigations that leave attackers able to return.