AWS solutions documentation change
Summary
Updated memory forensics tooling from Volatility2 to Volatility3, replaced references to 'volatility profile' with 'volatility symbol table', and added EKS cluster compatibility mention
Security assessment
The changes update documentation to use Volatility3, a newer memory analysis tool, and clarify symbol table usage. While this improves forensic capabilities (a security-related process), there is no explicit evidence of addressing a specific vulnerability or security incident. The update reflects tooling modernization rather than patching a security flaw.
Diff
diff --git a/solutions/latest/automated-forensics-orchestrator-for-amazon-ec2/post-deployment-plugin-points.md b/solutions/latest/automated-forensics-orchestrator-for-amazon-ec2/post-deployment-plugin-points.md index d447beeb8..05b2c1f06 100644 --- a//solutions/latest/automated-forensics-orchestrator-for-amazon-ec2/post-deployment-plugin-points.md +++ b//solutions/latest/automated-forensics-orchestrator-for-amazon-ec2/post-deployment-plugin-points.md @@ -5 +5 @@ -Memory forensics analysis using LiME and Volatility2 +Memory forensics analysis using LiME and Volatility 3 @@ -9 +9 @@ Memory forensics analysis using LiME and Volatility2 -The Guidance is designed to be an orchestrator and therefore allows the following plugin points where you can replace existing tooling with your preferred tool of choice. The Guidance leverages [LiME](https://github.com/504ensicsLabs/LiME) for memory capture and [Volatility2](https://github.com/volatilityfoundation/volatility/wiki/Linux) for memory investigation. +The Guidance is designed to be an orchestrator and therefore allows the following plugin points where you can replace existing tooling with your preferred tool of choice. The Guidance leverages [LiME](https://github.com/504ensicsLabs/LiME) for memory capture and [Volatility 3](https://github.com/volatilityfoundation/volatility3) for memory investigation. @@ -11 +11 @@ The Guidance is designed to be an orchestrator and therefore allows the followin - 1. A LiME module and volatility profile for the EC2 instance must be prebuilt and available for forensic memory investigation and investigation for the EC2 instances OS and kernel version. Refer to Plugin points to build the LiME module and volatility profile. + 1. A LiME module and volatility symbol table for the EC2 instance must be prebuilt and available for forensic memory investigation and investigation for the EC2 instances OS and kernel version. Refer to Plugin points to build the LiME module and volatility symbol table. @@ -13 +13 @@ The Guidance is designed to be an orchestrator and therefore allows the followin - 2. The prebuilt LiME module and volatility profile must be stored in the Guidance’s S3 bucket. The artifacts can be stored in the bucket created by the forensic Guidance in `cdk.json`. The prefix to the artifacts and the S3 bucket can be configured in `cdk.json` as context variable. + 2. The prebuilt LiME module and volatility symbol table must be stored in the Guidance’s S3 bucket. The artifacts can be stored in the bucket created by the forensic Guidance in `cdk.json`. The prefix to the artifacts and the S3 bucket can be configured in `cdk.json` as context variable. @@ -18 +18 @@ The Guidance is designed to be an orchestrator and therefore allows the followin -## Memory forensics analysis using LiME and Volatility2 +## Memory forensics analysis using LiME and Volatility 3 @@ -20 +20 @@ The Guidance is designed to be an orchestrator and therefore allows the followin -As described in [Memory forensics acquisition workflow implementation](./forensic-memory-and-disk-acquisition-service.html#memory-forensics-acquisition-workflow-implementation), memory forensics is implemented using Step Functions, which provides the orchestration mechanism and tuns the AWS Systems Manager automation documents. These automation documents can be partially or fully replaced. In the example below, we have bootstrapped our memory forensics implementation to acquire memory using [LiME](https://github.com/504ensicsLabs/LiME), and to use the _[ Volatility2](https://github.com/volatilityfoundation/volatility) _ profile. LiME is used to extract the volatile memory, which is then analyzed downstream by the Forensics investigation workflow. +As described in [Memory forensics acquisition workflow implementation](./forensic-memory-and-disk-acquisition-service.html#memory-forensics-acquisition-workflow-implementation), memory forensics is implemented using Step Functions, which provides the orchestration mechanism and tuns the AWS Systems Manager automation documents. These automation documents can be partially or fully replaced. In the example below, we have bootstrapped our memory forensics implementation to acquire memory using [LiME](https://github.com/504ensicsLabs/LiME), and to use the _[ Volatility 3](https://github.com/volatilityfoundation/volatility3) _ profile. LiME is used to extract the volatile memory, which is then analyzed downstream by the Forensics investigation workflow. @@ -22 +22 @@ As described in [Memory forensics acquisition workflow implementation](./forensi -When memory is investigated using Volatility 2 (and other tools) it is important for the tool to understand the structure of the memory. In Volatility 2, that is done using a profile which is comprised of two parts: a Debugging With Attribute Record Formats (DWARF) and a map (symbol table used by the kernel) file. The section below demonstrates how the process flow works and ensures that it can be extended by creating a new profile and dropping it into a configurable location (bucket). +When memory is investigated using Volatility 3 (and other tools) it is important for the tool to understand the structure of the memory. In Volatility 3, that is done using symbol tables which is comprised of two parts: a Debugging With Attribute Record Formats (DWARF) and a map (symbol table used by the kernel) file. The section below demonstrates how the process flow works and ensures that it can be extended by creating a new profile and dropping it into a configurable location (bucket). @@ -26 +26 @@ When memory is investigated using Volatility 2 (and other tools) it is important -As every OS and kernel versions have slight variations, you must create LiME and Volatility artifacts specific to the EC2 instance, and make these artifacts available to the orchestrator during run-time. +As every OS and kernel versions have slight variations, you must create LiME and Volatility artifacts specific to the EC2 instance or EKS cluster, and make these artifacts available to the orchestrator during run-time.