In the ever-evolving world of cybersecurity, incident response is crucial. When dealing with containerized environments like Openshift, traditional forensics methods often fall short. This is where platforms such as Cado Security’s come in, offering a streamlined approach to container forensics.
This blog will guide you through performing forensics on Openshift containers using Cado Security’s platform.
Prerequisites
- An Openshift cluster
- Cado account with access to a Cado Response instance
1. Generate a Collection Script
- Log in to the Cado platform, select or create a project and navigate to Import > Cado Host.
- Select the container operating system to generate a collection script.
2. Execute the Script on the Target Container
Now, execute the script on the target container, as such:
oc login --token=sha256~... --server=https://api.system.openshiftapps.com:443
oc exec pod-name -c container-name -- mkdir -p /tmp/cado-host
oc exec pod-name -c container-name -- curl -s https://cado-public.s3-accelerate.amazonaws.com/cado-host/v1.5.4/linux/cado-host --output /tmp/cado-host/cado-host
oc exec pod-name -c container-name -- chmod +x /tmp/cado-host/cado-host
oc exec pod-name -c container-name -- /tmp/cado-host/cado-host --presigned_data ...
3. Analyze the Collected Data
- The script will collect forensic data from the container and upload it to your Cado instance.
- Locate the Project associated with the container and start analyzing the collected data.
- The Cado platform will provide insights into the container’s activities, including files, processes, and network connections.
Benefits of using the Cado Platform to perform forensics on Openshift containers
- Automated Data Collection: The script automates the evidence collection process, ensuring critical data is captured quickly and efficiently.
- Forensic-Level Detail: Cado Response provides comprehensive analysis of the collected data, offering valuable insights into potential security incidents.
- Streamlined Workflow: The platform offers a centralized location for managing and analyzing forensic data, simplifying the overall investigation process.
For more information and to discuss how Cado can assist you with OpenShift forensics, please contact us or request a demo.