Darktrace Launches Automated Cloud Forensics Product
Summary
Darktrace announced a cloud-forensics product that automates evidence capture and investigation across cloud, hybrid, container, and SaaS environments, aiming to help security teams reconstruct attacker activity faster.
Key points
- The product can automatically begin forensic capture in response to alerts from existing cloud security, XDR, SIEM, or SOAR tools.
- It supports AWS, Azure, GCP, on-premises environments, and managed Kubernetes, including ephemeral and distroless containers.
- Evidence collection includes full-volume capture or faster triage collection of selected artifacts such as process data, logs, and network connections.
- The platform correlates commands, files, lateral movement, and network activity into attacker timelines and investigation reports.
- It can collect Microsoft 365, Entra ID, and Google Workspace logs for investigations involving account takeover, business email compromise, and insider threats.
- Darktrace says the product also identifies Linux vulnerabilities and malware, correlating findings with attacker timelines.
- Deployment options include a self-hosted virtual appliance and a SaaS-delivered service.
Article Details
- Event Type
- Darktrace announced Darktrace / Forensic Acquisition & Investigation, an automated cloud forensics solution.
- Impact
- The product automates evidence capture and investigation across cloud, hybrid, container, ephemeral, and SaaS environments, aiming to reduce investigations from days to minutes and provide root-cause analysis and attacker timelines.
Vendors
Products
AWSThe solution provides automated forensic acquisition across AWS, Microsoft Azure, GCP, and on-prem environments. It supports both full volume capture, creating a bit-by-bit copy of an entire storage device for the mostDarktrace / CLOUDMost importantly, the solution is natively integrated with Darktrace / CLOUD, turning real-time detections of novel attacker behaviors into full forensic investigations instantly. When Darktrace / CLOUD identifiesDarktrace / Forensic Acquisition & InvestigationThat’s why we built Darktrace / Forensic Acquisition & Investigation, the first automated forensic solution designed specifically for the speed, scale, and complexities of the cloud. It addresses both sets of challengesEntra IDBeyond infrastructure-level data, the solution collects logs from SaaS providers such as Microsoft 365, Entra ID, and Google Workspace. This enables investigations into common attack types like business email compromiseGCPThe solution provides automated forensic acquisition across AWS, Microsoft Azure, GCP, and on-prem environments. It supports both full volume capture, creating a bit-by-bit copy of an entire storage device for the mostGoogle Workspacedata, the solution collects logs from SaaS providers such as Microsoft 365, Entra ID, and Google Workspace. This enables investigations into common attack types like business email compromise (BEC), accountMicrosoft 365Beyond infrastructure-level data, the solution collects logs from SaaS providers such as Microsoft 365, Entra ID, and Google Workspace. This enables investigations into common attack types like business email compromiseMicrosoft AzureThe solution provides automated forensic acquisition across AWS, Microsoft Azure, GCP, and on-prem environments. It supports both full volume capture, creating a bit-by-bit copy of an entire storage device for the mostOpenShiftis no longer a blind spot. For hybrid organizations, this extends to on-premises Kubernetes and OpenShift deployments, bringing consistency across environments.