incident response – Noise

Incident response guide for AWS CloudTrail investigations – Part 2

Oscar Diaz — Thu, 03 Sep 2026 21:15:53 +0000

In Part 1 of this guide, we examined two common incident scenarios: cross-account Amazon Simple Storage Service (Amazon S3) data deletion with ransomware implications, and cryptocurrency mining deployed through AWS CloudFormation using exposed AWS Management Console credentials. We also introduced key incident response terminology and investigative frameworks for analyzing AWS CloudTrail events. In this second […]

Incident response guide for AWS CloudTrail investigations – Part 1

Oscar Diaz — Thu, 03 Sep 2026 21:15:39 +0000

AWS CloudTrail logs contain the evidence you need when investigating suspicious activity in your AWS environment, but knowing which fields matter and how to interpret them can mean the difference between surface-level analysis and uncovering the full scope of an incident. This guide walks you through real-world scenarios, showing you how to analyze CloudTrail events […]

AI IR Overlay – Incident Response Specification for AI Agents

Darknet — Fri, 28 Aug 2026 06:35:05 +0000

AI IR Overlay specifies containment for agents using valid credentials, with a working kill-switch contract and an admitted gap when no SOC is staffed.

Detecting multi-stage attacks on AWS: A guide to cross-service signal correlation

Nisha Kashyap — Wed, 26 Aug 2026 17:39:19 +0000

A single alert from one security service tells you something happened. Read that signal alongside activity from other services and your own business context, and you will know whether what happened is part of a multi-stage attack. Consider a short sequence. An identity calls GetCallerIdentity from a source address it hasn’t previously used. Within minutes, […]

Accelerating AWS Network Firewall troubleshooting with AWS DevOps Agent

Salman Ahmed — Fri, 24 Jul 2026 19:54:48 +0000

When an administrator introduces a rule change in AWS Network Firewall and network connectivity is disrupted, pinpointing the cause requires inspecting multiple points in the traffic path. The firewall gives you stateless and stateful rule engines, domain rules, and routing to the firewall endpoint inside your Amazon Virtual Private Cloud (Amazon VPC). A network drop […]

What Happened Between OpenAI and Hugging Face?

Wade Woolwine — Thu, 23 Jul 2026 12:47:05 +0000

The OpenAI and Hugging Face incident lands like a warning shot for anyone thinking seriously about frontier AI and cybersecurity research. A model evaluation crossed the neat boundary of a research environment, reached a live third-party production sys...

What the June 2026 Threat Technique Catalog update means for your AWS environment

Shannon Brazil — Mon, 29 Jun 2026 19:30:59 +0000

The AWS Customer Incident Response Team (AWS CIRT) encounters patterns that repeat across engagements when helping customers respond to security incidents. We’re passionate about making sure that information is accessible so that everyone can improve their security posture and their organization’s resilience to disruption. The primary method we use to share this information is the […]

How Cloudflare responded to the “Copy Fail” Linux vulnerability

Chris J Arges — Thu, 07 May 2026 13:00:00 +0000

When a critical Linux kernel privilege escalation was publicly disclosed, Cloudflare's security and engineering teams detected, investigated, and mitigated the threat across our global fleet, confirming zero customer impact and no malicious exploitation.

The Human Infrastructure: How Netflix Built the Operations Layer Behind Live at Scale

Netflix Technology Blog — Fri, 17 Apr 2026 15:01:02 +0000

By: Brett Axler, Casper Choffat, and Alo LowryIn the three years since our first Live show, Chris Rock: Selective Outrage, we have witnessed an incredible expansion of our live content slate and the live operations that support it. From modest beginnin...

ClickFix Phishing Campaign Masquerading as a Claude Installer

Nicholas Spagnola — Thu, 16 Apr 2026 13:00:00 +0000

OverviewIt is no secret that phishing campaigns utilizing various ClickFix techniques have been a commonly used method of social engineering. One of the main reasons for this is simply because they work. You know this and Rapid7 does as well. As a comp...

A framework for securely collecting forensic artifacts into S3 buckets

Jason Garman — Wed, 08 Apr 2026 18:19:00 +0000

When customers experience a security incident, they need to acquire forensic artifacts to identify root cause, extract indicators of compromise (IoCs), and validate remediation efforts. NIST 800-86, Guide to Integrating Forensic Techniques into Incident Response, defines digital forensics as a process comprised of four basic phases: collection, examination, analysis, and reporting. This blog post focuses […]

FortiGate CVE-2025-59718 Exploitation: Incident Response Findings

Eric Carey — Wed, 08 Apr 2026 13:39:52 +0000

Rapid7’s Incident Response (IR) team was engaged to investigate an incident involving exploitation of CVE-2025-59718 against a vulnerable FortiGate appliance. In December 2025, Fortinet disclosed this improper verification of cryptographic signature vu...

Cloudflare outage on February 20, 2026

David Tuber — Sat, 21 Feb 2026 00:00:00 +0000

Cloudflare suffered a service outage on February 20, 2026. A subset of customers who use Cloudflare’s Bring Your Own IP (BYOIP) service saw their routes to the Internet withdrawn via Border Gateway Protocol (BGP).

When protections outlive their purpose: A lesson on managing defense systems at scale

Thomas Kjær Aabo — Thu, 15 Jan 2026 20:54:32 +0000

User feedback led us to clean up outdated mitigations. See why observability and lifecycle management are critical for defense systems.

The post When protections outlive their purpose: A lesson on managing defense systems at scale appeared first on The GitHub Blog.

Cryptomining campaign targeting Amazon EC2 and Amazon ECS

Kyle Koeller — Tue, 16 Dec 2025 22:12:57 +0000

Amazon GuardDuty and our automated security monitoring systems identified an ongoing cryptocurrency (crypto) mining campaign beginning on November 2, 2025. The operation uses compromised AWS Identity and Access Management (IAM) credentials to target Amazon Elastic Container Service (Amazon ECS) and Amazon Elastic Compute Cloud (Amazon EC2). GuardDuty Extended Threat Detection was able to correlate signals […]

Practical steps to minimize key exposure using AWS Security Services

Jennifer Paz — Fri, 21 Nov 2025 21:07:32 +0000

Exposed long-term credentials continue to be the top entry point used by threat actors in security incidents observed by the AWS Customer Incident Response Team (CIRT). The exposure and subsequent use of long-term credentials or access keys by threat actors poses security risks in cloud environments. Additionally, poor key rotation practices, sharing of access keys […]

Accelerate investigations with AWS Security Incident Response AI-powered capabilities

Daniel Begimher — Fri, 21 Nov 2025 18:47:13 +0000

If you’ve ever spent hours manually digging through AWS CloudTrail logs, checking AWS Identity and Access Management (IAM) permissions, and piecing together the timeline of a security event, you understand the time investment required for incident investigation. Today, we’re excited to announce the addition of AI-powered investigation capabilities to AWS Security Incident Response that automate […]

Introducing REACT: Why We Built an Elite Incident Response Team

Chris O’Rourke — Thu, 09 Oct 2025 14:00:00 +0000

We're launching Cloudforce One REACT, a team of expert security responders designed to eliminate the gap between perimeter defense and internal incident response.

Empowering Netflix Engineers with Incident Management

Netflix Technology Blog — Fri, 19 Sep 2025 16:48:00 +0000

By: Molly StruveNetflix’s mission to provide seamless entertainment to hundreds of millions of users globally demands exceptional reliability. At the heart of this reliability is how we handle incidents — those inevitable moments when something doesn’t...

AWS CIRT announces the launch of the Threat Technique Catalog for AWS

Steve de Vera — Fri, 13 Jun 2025 15:22:16 +0000

Greetings from the AWS Customer Incident Response Team (AWS CIRT). AWS CIRT is a 24/7, specialized global Amazon Web Services (AWS) team that provides support to customers during active security events on the customer side of the AWS Shared Responsibility Model. We’re excited to announce the launch of the Threat Technique Catalog for AWS. When […]