Summary

As we’ve seen through this chapter, the basics of the incident response process and threat hunting largely remain the same, focusing on finding evil within the environment. Depending on the operating systems, investigators can customize what logs and artifacts should be collected and what must be investigated. We also saw how EDR deployments speed up the breach containment and incident response process. Remember, the incident response process is a discipline that investigators closely follow to ensure that all the investigative steps are performed. At the same time, the breach is contained, and there is no further risk to the organization and the endpoint under investigation. While this chapter aimed to introduce various elements of the breach investigation, it is undoubtedly encouraged that investigators stay up to date with the latest investigative tools and techniques.

In the next chapter, we will look at collecting these artifacts from the cloud environment. Recognizing...