A python module for orchestrating content acquisitions and analysis via amazon ssm. Note: This is a pre-release.
- Free software: MPL 2.0 License
- Documentation: https://ssm-acquire.readthedocs.io.
- Acquire memory from a linux instance to an S3 bucket using SSM.
- Interrogate an instance for top-10 IOCs using OSQuery and save the jsonified output.
- Analyze a memory sample on a machine using docker.
- Create a rekall profile using an instance as a build target running the Amazon SSM Agent.
pip install ssm_acquire Usage: ssm_acquire [OPTIONS] ssm_acquire a rapid evidence preservation tool for Amazon EC2. Options: --instance_id TEXT The instance you would like to operate on. --region TEXT The aws region where the instance can be found. --build Specify if you would like to build a rekall profile with this capture. --acquire Use linpmem to acquire a memory sample from the system in question. --interrogate Use OSQuery binary to preserve top 10 type queries for rapid forensics. --analyze Use docker and rekall to autoanalyze the memory capture. --deploy Create a lambda function with a handler to take events from AWS GuardDuty. --help Show this message and exit.
This package was created with Cookiecutter and the audreyr/cookiecutter-pypackage project template.