SMX Cyber Hunt and Incident Response

Take your cyber forensics to the next level with SMX!

Utilize real-world hunt, cyber forensics, and incident response capabilities with a collection of tools and experts. We analyze the metadata associated with over 100 specific AWS services and align client security posture with the AWS Well-Architected framework, security industry standards, and best practices.

# Cloud-Based Hunt *** Utilize a custom security assessment tool in combination with AWS services, such as System Manager, Chatbot, Security Hub, and OpenSearch, to provide a summarized threat analysis

• Utilize assessment results to hunt down threats in an AWS account proactively
• Identify vulnerable points before they are exploited in the wild
• Utilize detection methods to deploy AWS response playbooks and automate responses to malicious activity in the future**

**# Incident Response Support

• Offer specific guidance on how to respond effectively to suspected compromises or ongoing incidents
• Utilize historic logs stored in S3, such as VPC Flow, Load Balancer, CloudWatch, S3 access, and CloudTrail, to detect past compromises and determine how a threat actor was able to gain an initial foothold
• Perform containment and eradication on compromised host, service, and network resources
• Provide a root-cause-analysis that informs further post-incident activities**

# Training and Guidance

• Provide strategic guidance and documentation to harden against advanced and persistent attacks
• Deliver remediation recommendations to remove sophisticated actors from Amazon infrastructure and quickly restore affected services
• Identify specific indicators of compromise (IOCs) and quickly leverage network, host, and cloud-based signatures in the future