Dead Container Walking: Post-Incident Analysis When Your Workload Is Already Gone

In Kubernetes, compromised containers often disappear before investigators can respond, leaving no disk, process state or live system to inspect.

This talk explores how attackers exploit ephemeral workloads and why traditional forensic approaches fail in cloud-native environments.

Attendees will leave with a blueprint for building forensically ready clusters where even the most ephemeral workloads leave a permanent mark.

Forensic Readiness Standardization: Transforms the industry from reactive cleanup to proactive readiness by defining a clear standard for capturing volatile evidence in staging Kubernetes environments.

Bridging Security and Observability: Unite DevSecOps teams by demonstrating how SREs and platform engineers can leverage existing observability signals to conduct active security investigations.

Democratizing threat detection: Lowers the barrier to entry for robust security by showing how open source tools provide enterprise level forensics capabilities without expensive proprietary software