These are tools discussed Learning Ransomware Response & Recovery by W. Curtis Preston and Dr. Mike Saylor. Browse the list of all tools or get the book.
Inclusion in this directory does not indicate endorsement.
If you see a missing tool, leave a comment!
Cloud platform tools provide logging, monitoring, threat detection, and security analytics capabilities specific to major cloud service providers.
AWS
- AWS CloudTrail – https://aws.amazon.com/cloudtrail – Activity logging and auditing
- AWS CloudWatch – https://aws.amazon.com/cloudwatch – Monitoring and logging
- AWS EC2 – https://aws.amazon.com/ec2 – Virtual machine instances
- AWS GuardDuty – https://aws.amazon.com/guardduty – Threat detection service (has free tier)
Azure
- Microsoft Sentinel – https://azure.microsoft.com/en-us/products/microsoft-sentinel – Cloud-native SIEM
- Azure Monitor – https://azure.microsoft.com/en-us/products/monitor – Comprehensive monitoring solution
- Azure Activity Logs – https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log – Resource activity tracking
Google Cloud
- Google Chronicle – https://chronicle.security – Massive-scale security analytics
- Google Cloud Audit Logs – https://cloud.google.com/logging/docs/audit – Activity monitoring
- Google Security Command Center – https://cloud.google.com/security-command-center – GCP security monitoring