Don't Repeat Yourself - Automating Malware Incident Response for Fun and Profit

Don't Repeat Yourself - Automating Malware Incident Response for Fun and Profit

Explore automation techniques for malware incident response in this 30-minute conference talk from BSidesLV 2016. Gain insights into the roles of malware analysts and digital forensics tools, with a focus on OSX Collector and ISAC Selector. Learn about JSON entry examples, visualization techniques, and output filters. Discover how to leverage S3 event notifications, execute analysis filters, and interpret results. Understand the benefits of automating forensics collections, including time savings and improved interaction between analysts and help desk. Examine a script example and consider the advantages of remote collection methods. Conclude with a discussion on sandboxing and potential pitfalls in malware incident response automation.