HOW TO AUTOMATE INCIDENT RESPONSE FOR AMAZON EKS ON AMAZON EC2

Summary from the TLDR InfoSec newsletter

This AWS blog post explains how to automate incident response for Amazon EKS clusters, highlighting key differences from EC2 response procedures. It covers EKS-specific challenges like pod-to-process mapping, network isolation using cordoning and network policies, and presents a customized automated forensics solution that handles acquisition, isolation, investigation, and reporting for EKS security events.