Results for “container-forensics”

Audits Kubernetes pods for container escape vectors by analyzing privileged mode, dangerous capabilities, host namespace sharing, and writable hostPath mounts using the Kubernetes Python client.

Detect container escape attempts in real-time using Falco runtime security rules that monitor syscalls, file access, and privilege escalation.

Implements container security with image scanning, runtime protection, image signing, and security policies using tools like Falco, Trivy, and Notary.

Scan container images, filesystems, and Kubernetes manifests for vulnerabilities, misconfigurations, exposed secrets, and license compliance issues using Aqua Security Trivy with SBOM generation and CI/CD integration.

Guides authorized digital forensics and incident response workflows including memory dump analysis, disk timeline creation, PCAP investigation, and artifact triage with evidence preservation.

Detect container escape attempts using Falco, seccomp, and auditd, with rules for privileged containers, Docker socket access, and kernel module loading.

Authorized security assessment for cloud, container, and Kubernetes environments covering metadata SSRF, IAM misconfigurations, container escape paths, and cluster RBAC review.

Run CIS Kubernetes Benchmark checks and remediate findings with kube-bench.

Integrate Trivy vulnerability scanning into CI/CD pipelines to detect container image CVEs, Dockerfile misconfigurations, and enforce severity-based quality gates.

Analyzes container security posture, image assurance, compliance, and runtime alerts on the Aqua Security platform via its API.

Perform forensic on-chain analysis of EVM tokens to detect scams, rug pulls, and soft rugs by cross-referencing on-chain state against team narratives.

Deploy and configure Velociraptor for scalable endpoint forensic artifact collection during incident response using VQL queries, hunts, and pre-built artifact packs across Windows, Linux, and macOS environments.

Scan container images, IaC, and SBOMs for vulnerabilities and misconfigurations in CI/CD with Trivy.