Incident response and forensics

Handling the security breaches over the computer network and system is a challenging and head-breaking task for computer architects. While security incidents and losses are on the rise, many organizations don’t have a plan in place to diagnose and handle a breach. While you can’t prevent every possible incident, our Detection and Response team can help you to respond quickly and minimize damage and downtime when attacks and exploits occur. We take a comprehensive and proactive approach to help you protect, detect, correct, and adapt.

The Mozilla Defense Platform (MozDef) automates incident handling by giving defenders a platform where they can monitor, react to, and collaborate on security incidents in real time. MozDef uses Elasticsearch, Meteor, and MongoDB to expand traditional SIEM capabilities with incident response and visualizations. MozDef is a mature platform currently in use at Mozilla.

OS X Auditor parses and hashes kernel extensions, system agents and daemons, third-party agents, downloaded files, and installed applications on a running system (or a copy). The forensics tool extracts user information such as quarantined files, browser history and cookies, file downloads, LastSession, HTML5 databases and local store, login data, social and email accounts, and saved wireless connections. OS X Auditor verifies the reputation of each file from multiple sources as part of a forensics investigation.

Tailored for Microsoft and Unix systems, Sleuth Kit lets investigators identify and recover evidence from live systems, as well as images created as part of incident response. Investigators can analyze file contents, automate specific procedures, and perform MD5 image integrity checks. The kit is more of a library and collection of command-line tools, and investigators should use Autopsy -- the graphical interface for Sleuth Kit -- to access the tools.

GRR Rapid Response is an incident response framework focused on remote live forensics for Linux, OS X, and Windows clients. Investigators install the Python agent on target systems for live remote memory analysis, to collect digital forensics artifacts, and perform detailed systems monitoring for CPU, memory, and I/O usage. GRR also uses SleuthKit to give investigators raw file system access.