Cloud Native Forensics: Challenges and Best Practices

### Executive Summary This whitepaper describes the challenges of cloud-native forensics—short-lived containers, serverless functions, and distributed orchestration—and recommends enabling cloud provider logs, centralizing persistent application and runtime logs, and using dynamic threat analysis (DTA) to detect hidden/fileless malware, reconstruct attack kill chains, and improve incident response in containerized and serverless environments.