DFIR Docker Collector
A tool that runs from the host and collects logs and evidence from all selected Docker containers in a single run, quickly and consistently.
Containers and incident response
Nowadays more and more applications run in containers. They are fast to deploy, portable across environments and easy to scale. They also isolate applications from each other and from the host, so many organizations treat them as part of their security strategy.
For incident responders, the same features are a problem. A single host can run dozens of containers, often short-lived and built on minimal images with no tools inside. Entering each container one by one to collect evidence takes a lot of time, can alter the evidence itself, and the logs are often scattered between the container, its volumes and the host.
The tool
DFIR Docker Collector makes this easier. It runs from the host machine and collects the logs and evidence of all selected containers in a single run, so analysts can gather what they need quickly and in a consistent way.
Repository and contributions
Details on how the tool works, and future updates, are in the repository: github.com/ScreSys/dfir-docker-collector.
Anyone who wants to contribute, suggest a change or modify something can write to [email protected].