Cyber Triage

Allows you to conduct a mini-forensic investigation on an endpoint. It pushes a collection tool to the remote endpoint, collects volatile and file system data, and analyzes the data.

Endpoint · Cyber Triage

Details

ID	`Cyber Triage`
Provider	Basis Technology
Category	Endpoint
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Overview

Use the Cyber Triage integration to collect and analyze endpoint data

This integration requires Team version of Cyber Triage (not the Standalone desktop version).

This integration was integrated and tested with Cyber Triage v2.4.0.

Configure Cyber Triage on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for Cyber Triage.
Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- Hostname of Cyber Triage server (e.g. 192.168.1.2) : the ip or hostname where the Cyber Triage server is setup.
- REST Port : REST port for Cyber Triage server. 9443 is the default port and currently cannot be changed in Cyber Triage.
- API Key : can be retrieved from the Cyber Triage server by going to Options -> Deployment Mode -> REST API Key.
- Username : the username and password of a Windows account with administrative privileges on all endpoints that need to be investigated.
- Use proxy : select if you have a proxy setup in your environment and need to use it to reach the Cyber Triage server.
Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

Initiate a collection on an endpoint: ct-triage-endpoint

Initiate a collection on an endpoint

Initiates a Cyber Triage collection on an endpoint.

Base Command

ct-triage-endpoint

Input

Argument Name	Description	Required
endpoint	IP or hostname of a Windows endpoint	Required
full_scan	Scan the entire file system for suspicious files	Optional
malware_hash_upload	Send MD5 hashes to an external malware analysis service	Optional
malware_file_upload	Send unknown files to an external malware analysis service. Hash upload must be enabled to execute file uploads.	Optional

Context Output

Path	Type	Description
CyberTriage.SessionId	string	The session ID for the newly created session
Endpoint.IPAddress	string	The endpoint IP address that Cyber Triage investigated
Endpoint.Hostname	string	The endpoint hostname that Cyber Triage investigated

Command Example

!ct-triage-endpoint endpoint=ct-win10-01 full_scan=no

Context Example

CyberTriage.SessionID: ct-win10-01|1538074422288
CyberTriage.Hostname: ct-win10-01

Human Readable Output

A collection has been scheduled for ct-win10-01

Configuration parameters

server — Hostname of Cyber Triage server (e.g. 192.168.1.2) (required)
rest_port — REST Port (required)
api_key —
credentials — Username (required)
use_proxy — Use proxy

Commands (1)

ct-triage-endpoint
initiates a cyber triage collection on an endpoint.

Source

CyberTriage.py CyberTriage_test.py CyberTriage.yml CyberTriage_description.md

Download History Raw

commonfields:
  id: Cyber Triage
  version: -1
name: Cyber Triage
display: Cyber Triage
category: Endpoint
provider: Basis Technology
description: 'Allows you to conduct a mini-forensic investigation on an endpoint. It pushes a collection tool to the remote endpoint, collects volatile and file system data, and analyzes the data. '
configuration:
- display: Hostname of Cyber Triage server (e.g. 192.168.1.2)
  name: server
  defaultvalue: ""
  type: 0
  required: true
- display: REST Port
  name: rest_port
  defaultvalue: "9443"
  type: 0
  required: true
- displaypassword: API Key
  name: api_key
  type: 9
  hiddenusername: true
  required: false
- display: Username
  name: credentials
  defaultvalue: ""
  type: 9
  required: true
- display: Use proxy
  name: use_proxy
  defaultvalue: "true"
  type: 8
  required: false
script:
  script: ''
  type: python
  subtype: python3
  commands:
  - name: ct-triage-endpoint
    arguments:
    - name: endpoint
      required: true
      default: true
      description: IP or hostname of a windows endpoint.
    - name: scan_options
      description: Comma separated list of data types that Cyber Triage will collect. Processes (pr), Network (nw),  Network Caches (nc), Startup Items (st), Scheduled Tasks (sc), Program Run (ru),  System Config (co), User Logins (lo), Network Shares (ns), Web Artifacts (wb), Full File System Scan (fs).
      defaultValue: pr,nw,nc,st,sc,ru,co,lo,ns,wb,fs
    - name: malware_hash_upload
      auto: PREDEFINED
      predefined:
      - "yes"
      - "no"
      description: Send MD5 hashes to external malware analysis service.
      defaultValue: "yes"
    - name: malware_file_upload
      auto: PREDEFINED
      predefined:
      - "yes"
      - "no"
      description: Send unknown files to external malware analysis service. Hash upload must be enabled for file uploads to occur.
      defaultValue: "no"
    - name: incident_name
      description: Cyber Triage incident name that the collection will belong to.
      defaultValue: Default
    outputs:
    - contextPath: CyberTriage.SessionId
      description: The session ID for the newly created session.
      type: string
    - contextPath: Endpoint.IPAddress
      description: The endpoint IP address that Cyber Triage investigated.
      type: string
    - contextPath: Endpoint.Hostname
      description: The endpoint hostname that Cyber Triage investigated.
      type: string
    description: initiates a cyber triage collection on an endpoint.
  dockerimage: demisto/python3:3.12.13.10116658
tests:
- No test - no instance
fromversion: 5.0.0