Making your network ready for Cyber Forensics Analysis
summary
Shows a small Python toolkit that runs three quick checks — auditctl checks for kernel audit rules, verifies syslog/CIS logging, and inspects crontab plus new RPM installs — and reports pass/fail. Demonstrates running the scripts on a VM, explains running them as a cron job to collect and archive evidence periodically, and links code to GitHub repo "open source cyber security/Extreme python". Mentions ~50–60 reusable functions in development and recommends sudo-restricted execution for privileged commands.
AI-written summary · about
chapters (7)
- 0:00Introduction to talk
- 2:10What is cyber forensics
- 5:43Making network forensics ready
- 8:32Demo setup and code overview
- 12:50Live demo of forensic checks
- 18:31Scaling forensic evidence collection
- 20:14Best practices and Q&A
related talks
34mBuild Your First Cyber Forensic Application using Python
28mBuild your first Cyber Forensic Application
14mDFIR - Don't Forget Your Roots!
28m"Cyber Security Investigations with Jupyter Notebooks"
33mCommSec D1 - Faster, Wider, Greater: Modern Pentest Tricks
22mMalware Hunting - Using python as an attack weapon
29mContainer Forensics for Kubernetes: Building an Evidence Pipeline With Open Source…
58mScalable and sustainable Cybersecurity