CyArt Academy
Unlock ProSign in
CYART // SCHEMA · EDR-TELEMETRY7 NODES · 7 LINKSEVENTSVERDICTCOMMANDACTOR · Endpoints — 50k agents, 1 kB/s eachACTOR01Endpoints50k agents, 1 kB/s eachEDGE · Ingest gateway — mTLS, per-agent tokenEDGE02Ingest gatewaymTLS, per-agent tokenSTREAM · Buffer — Kafka, 72 h retentionSTREAM03BufferKafka, 72 h retentionSERVICE · Real-time rules — Sigma, 1 s budgetSERVICE04Real-time rulesSigma, 1 s budgetSERVICE · Batch analytics — hunting, baselinesSERVICE05Batch analyticshunting, baselinesEDGE · Response — isolate host, kill procEDGE06Responseisolate host, kill procDATA · Data lake — Parquet, 1 yDATA07Data lakeParquet, 1 y

Forensics and evidence engineering

Build the system before the incident: evidence pipelines for memory, disk and cloud snapshots, chain of custody, trustworthy timestamps, triage collection across thousands of hosts, retention that answers the questions investigators ask, and legal hold.

🔒 PROLesson·11 min read·Advanced → Staff
forensicsDFIRchain of custodyVelociraptorlegal hold

01Collect in order of volatility

✓What you will learn
  • Order evidence collection by volatility and know what each source answers
  • Build an automated cloud evidence pipeline into an isolated account
  • Keep a defensible chain of custody with hashes and access logs
  • Run triage collection at scale with Velociraptor-style hunts
  • Set retention and legal hold so the data still exists when you need it
SourceVolatilityAnswersTooling
MemoryLost on reboot or isolation that rebootsInjected code, decrypted payloads, network sockets, keys in useAVML, LiME, WinPmem, Volatility 3
Running stateSeconds to minutesProcess tree, open connections, logged-in usersEDR live response, osquery, Velociraptor
Disk / volumeDays, until overwrittenDropped files, persistence, shell history, timelineEBS / PD snapshots, dd, Plaso
Cloud control planeRetention settingWho called which API, from where, with which roleCloudTrail, GCP Audit Logs, Entra sign-ins
NetworkOften not keptExfil volume, C2 destinationsVPC Flow Logs, DNS logs, proxy logs
!Containment can destroy evidence

Terminating an instance, reimaging a laptop or letting autoscaling replace a node throws away memory and sometimes disk. Runbooks must say snapshot and capture memory, then isolate, and the auto-scaling group must be told to stop replacing the host.

◎Interview radar

A common prompt: "an EC2 instance is calling a known C2 address, what do you do in the first 15 minutes?" Strong answers tag it, detach from the ASG, snapshot volumes, capture memory, swap the security group to an isolation group, and only then think about terminating.

This is an advanced module

Detection & Response Engineering is part of the Pro pass. 3 more sections — the deep dives, the final design, follow-ups and the test — unlock with it.

Enter access codeSee Pro pass

Already a cyart.io or studio.cyart.io member? Your pass code is in your Studio account.

Related lessons