Intro to forensics in the cloud: A container was compromised. What’s next?

This article provides guidelines for a forensic cyber security process in cloud computing, including gathering relevant data and investigating it to gain insight into a breach.

The author explains the differences between traditional and cloud forensic processes and provides a cheat sheet for sources of data.

The article also includes an example of a forensic investigation triggered by a reverse shell attack on a Kubernetes pod.