Wiz launches cloud digital forensics capabilities for incident response
Summary
Wiz says its Digital Forensics capabilities let teams copy potentially compromised cloud workload volumes to a forensic account and download investigation packages, including runtime details for customers using its Runtime Sensor.
Key points
- Teams can copy potentially compromised workload volumes to a dedicated forensic account for investigation without running collection scripts on the workload.
- The platform can provide a forensic package containing security logs and artifacts for initial triage.
- For organizations using Wiz’s Runtime Sensor, a runtime package can include running processes, executed commands, and network connection IPs.
- Wiz says the capabilities are designed to speed evidence collection and support incident investigation without interrupting workload performance.
Article Details
- Event Type
- Product launch
- Impact
- Wiz launched Digital Forensics capabilities to help security and incident response teams collect forensic evidence from potentially compromised cloud workloads. The offering supports agentless volume copying, forensic-package downloads, and—when used with the Runtime Sensor—collection of running-process, executed-command, and network-connection information.
Vendors
Products
Wiz Digital Forensicsdetection & response or from an EDR solution, security and incident response teams can easily use Wiz Digital Forensics to copy volumes of the potentially compromised workload to a dedicated forensic account and thenWiz Runtime Sensoror self-developed scripts on the compromised workload. Organizations that use our newly launched Runtime Sensor can also receive a runtime forensic package that includes information on running processes, commands