Results for “forensic-acquisition”

Investigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to identify malicious activity and evidence.

Federal acquisition compliance auditor for the active Theseus workspace, backed by live FAR/DFARS text via the vendored `ecfr` MCP. USE WHEN the user asks to audit FAR/DFARS clause coverage, validate that cited clauses actually exist in eCFR (catch fabricated or typo'd numbers), check whether a cited clause has been amended since the solicitation issued, validate regulatory references (NIST SP, DAFI, MIL-STD), check that every "shall" requirement has a deliverable, find missing compliance artifacts, audit proposal_instruction ↔ evaluation_factor coverage (UCF Section L↔M or non-UCF equivalent — FAR 16 task orders, FOPRs, BPA calls, OTAs), or "are we compliant with the proposal instructions?". Cross-references the workspace's clause / regulatory_reference / requirement / deliverable / compliance_artifact entities against live eCFR and flags gaps with severity. Format-agnostic. DO NOT USE FOR drafting compliant prose (use proposal-generator) or extracting clauses (Theseus pipeline does that automatically).

Deploy and configure Velociraptor for scalable endpoint forensic artifact collection during incident response using VQL queries, hunts, and pre-built artifact packs across Windows, Linux, and macOS environments.

Deploys and manages Falco YAML rules for runtime threat detection in containers and Kubernetes, monitoring syscalls for shell spawns, file tampering, network anomalies, and privilege escalation. Parses Falco alerts for incident response.

Query AWS CloudTrail, VPC Flow Logs, S3 access logs, and ALB logs with Athena for forensic investigation of security incidents.

Detects and responds to OAuth token theft and replay attacks in cloud environments, focusing on Microsoft Entra ID token protection, conditional access policies, and sign-in anomaly detection.

Responds to security incidents in cloud environments (AWS, Azure, GCP) by performing identity-based containment, cloud-native log analysis, resource isolation, and forensic evidence acquisition adapted for ephemeral cloud infrastructure.