Beyond manual forensics: Booking.com's approach to orchestrating incident response
Browser history can play a critical role in incident response, from helping analysts reconstruct user activity and validating alerts, to uncovering malicious behavior. But retrieving raw artifacts from endpoints is often slow, manual, and inconsistent. In this technical session, Ahmad Aziz, Security Engineer II at Booking.com, will share his winning entry from the 2024 “You Did WHAT?! With Tines” (YDWWT) competition: a fully automated workflow that pulls raw browser history artifacts from devices using CrowdStrike and prepares them for offline forensic analysis.