The talk "Digital Forensics & Incident Response Automation in the Cloud" will focus on the benefits and challenges of automating Digital Forensics and Incident Response (DFIR) in cloud environments. As more organizations move their workloads to the cloud, there is a growing need for automation to handle security incidents at scale. This talk will cover the key concepts of cloud environments, including Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS), and Software-as-a-Service (SaaS). We will discuss the benefits of automating DFIR in the cloud, including increased efficiency, faster incident response times, and reduced manual errors. We will also discuss the challenges of automating DFIR in the cloud, including the need for specialized tooling, the complexity of cloud environments, and the security implications of automated workflows.

1. Digital Forensics &
Incident Response
Automation in the Cloud
Cado Security | 1

2. MTTR Costs
https://www.cadosecurity.com/improving-mttr-mean-time-to-respond-through-automation/

3. SOAR
https://www.cadosecurity.com/automate-incident-response-with-the-new-tines-and-cado-
response-integration/

4. Automation in Cado
Guarduty
Detection Positive
Analyst
Reviews Alert
Snapshots
System
Retrieves
Snapshots for
Analysis
Process and
Investigate
Snapshot
Isolate System
Without Cado
8+ Hours and Manual
To manually respond and resolve the incident
Guarduty
Detection
Isolate System
With Cado //
Minutes and Automated
To automatically respond and resolve the incident
Positive
Minutes
// Cado Automation

5. See Also…
Automate incident response and forensics
https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/automate-incide
nt-response-and-forensics.html
Overview of automated investigations
https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/automat
ed-investigations
Chronicle Security Operations / Chronicle SOAR
https://cloud.google.com/solutions/chronicle-security-operations

6. Cado Response
Free 14-day trial
Receive unlimited access to
the Cado Response Platform
for 14 days.
www.cadosecurity.com/free-investigation/