Snapshot Sleuth is a cloud-native forensics and incident-response platform built on AWS, designed to automate the analysis of EBS snapshots for security investigations.
The system uses AWS Step Functions to orchestrate the forensic workflow:
Snapshot Event → Validation → Preparation → Analysis → Upload → Notification → Cleanup
Each step is implemented as a Lambda function or parallel execution of multiple tools.
Four integrated forensic tools run in parallel during analysis:
- YARA: Rule-based pattern matching and detection
- ClamAV: Malware scanning and virus detection
- Wolverine: Artifact extraction and classification
- Log2Timeline: Timeline generation for incident reconstruction
S3 Buckets:
├── Evidence Bucket # Encrypted storage for forensic evidence
├── Artifacts Bucket # Tool outputs and analysis results
└── Logs Bucket # CloudTrail and application logs
The pluggable adapter layer provides vendor-neutral integration:
AdapterFactory
├── Case Management (GitHub, Jira, Linear, Custom)
├── Ticketing (GitHub, Jira, Zendesk, Custom)
└── Notifications (Slack, Email, Webhook)Modern React application with:
- Real-time case monitoring
- Evidence browser
- Workflow status tracking
- Dark mode support
- KMS encryption for data at rest
- IAM roles with least-privilege access
- VPC isolation for analysis environments
- CloudTrail audit logging
- Security group restrictions
- CloudWatch Dashboards for metrics
- Custom alarms for failures
- Structured logging with correlation IDs
- Distributed tracing with X-Ray
- Parallel tool execution
- Auto-scaling Lambda functions
- S3 for unlimited storage
- DynamoDB for case metadata (future)
- Infrastructure: AWS CDK (TypeScript)
- Backend: Lambda (TypeScript, Python)
- Frontend: React + Vite + TypeScript
- Monorepo: Bun workspaces + Turborepo
- CI/CD: GitHub Actions