🚨 When an EKS cluster is compromised, evidence spans the control plane, nodes & AWS. Yet almost nothing is logged by default. @ekt0plasm.bsky.social’s new post maps EKS data sources & tools for DFIR: audit logs, GuardDuty, CloudTrail, and ready-to-use queries ⬇️ www.synacktiv.com/en/publicati...
0 reposts1 like