The Challenge
When a breach is discovered—whether moments after it begins or days after the fact—the forensic investigation clock starts immediately. Security teams must reconstruct a complete attack timeline to understand:
- Which credentials or services were the initial entry point
- What resources were accessed or modified during the intrusion
- Whether data was exfiltrated and from where
- How far lateral movement progressed within the AWS environment
- What containment actions are required and whether they’ve been fully effective
Without the right tooling, investigators spend days manually searching CloudTrail event logs across date ranges, retrieving historical CloudWatch data, cross-referencing GuardDuty findings, and trying to manually join evidence from disparate sources. Critical connections get missed. Legal and regulatory deadlines get missed. And attackers potentially maintain access longer than necessary.
The Autohive Solution
The AWS Security integration equips Autohive agents to execute comprehensive forensic investigations by automating data retrieval across CloudTrail, CloudWatch, and GuardDuty simultaneously. Investigators get complete, correlated evidence assembled rapidly—enabling faster containment decisions and more thorough breach documentation.
Deep CloudTrail Event Search
Search CloudTrail management events by specific event names, user identities, or resource ARNs across your defined investigation time window. Reconstruct the exact sequence of API calls made by a compromised credential or malicious actor without manual log parsing.
Historical CloudWatch Data Retrieval
Retrieve metric statistics over any specified time period to understand what was happening in the environment before, during, and after the attack. Identify anomalous resource usage patterns that corroborate other forensic evidence.
GuardDuty Historical Finding Analysis
Access detailed GuardDuty findings—including archived ones—to understand the full threat detection timeline. Correlate behavioral detections with CloudTrail API call evidence to build a comprehensive picture of attacker techniques.
Multi-Trail Forensic Coverage
Describe all configured CloudTrail trails in your account and retrieve their logging status and event selectors. Ensure your investigation covers all active trails and identify any gaps in logging coverage that may limit forensic visibility.
Benefits
- Faster investigation timelines - Automated data retrieval compresses days of manual searching into hours
- Complete forensic context - CloudTrail, CloudWatch, and GuardDuty evidence assembled and correlated automatically
- Breach scope accuracy - Comprehensive event searching reduces the risk of missing lateral movement or exfiltration evidence
- Legal and regulatory support - Detailed, retrievable evidence packages support legal proceedings and regulatory notifications
- Repeatable investigation methodology - Defined forensic workflows ensure consistent evidence collection across all incidents
How It Works
- Scope definition - Define the investigation time window, relevant resources, and suspected user identities or event types
- CloudTrail search - Autohive queries CloudTrail management events by the defined attributes, retrieving all matching API call records
- CloudWatch historical retrieval - Metric statistics are retrieved for relevant resources across the investigation period to identify anomalous activity
- GuardDuty correlation - Historical GuardDuty findings, including archived ones, are retrieved and correlated with CloudTrail evidence
- Trail coverage verification - All configured trails are described and their logging status confirmed to identify forensic coverage gaps
- Evidence package assembly - All retrieved data is structured into a coherent forensic timeline for investigator review, legal use, or regulatory reporting
Getting Started
- Sign up at app.autohive.com
- Connect the AWS Security integration from the marketplace
- Configure your forensic investigation parameters including account scope and event attribute filters
- Deploy your forensic investigation agent
