Vol. VI
DevSecOps Forensics & Incident Response
Evidence architecture, investigation playbooks and AI-agent forensics
§ 01, What it's about
Evidence architecture first, then investigation playbooks for pipelines, supply chain, infrastructure and identity, then forensics for AI agents. The incident timeline on the series page is the spine of the playbooks.
§ 02, What I want the reader to be able to do
- 01
Design a delivery system so that an investigation has evidence to work with.
- 02
Run a structured investigation of a pipeline, supply-chain, infrastructure or identity incident.
- 03
Reconstruct an AI agent’s actions from its session record and say whether it was manipulated.
§ 03, The diagram I keep coming back to
Scrolls sideways →
§ 04, Planned structure
- Part I
Evidence architecture
What to log in a delivery system, where to keep it so that it stays unaltered, and how to document chain of custody.
- Part II
Investigation playbooks: pipeline and supply chain
Structured investigations of a compromised pipeline or a malicious dependency: detection, timeline, preservation.
- Part III
Investigation playbooks: infrastructure and identity
Container escape, abused cloud credentials, lateral movement and privilege escalation, with the acquisition steps for each.
- Part IV
AI agent forensics
Recording agent sessions, the log schema for tool calls, and reconstructing an incident from raw logs.
- Part V
Forensics readiness and governance
Assessing how ready a delivery organisation is to investigate, legal hold, and fitting readiness into an existing DevSecOps programme.
§ 05, When it's readable