Illusive-Collect-Forensics-On-Demand

This playbook is used to collect forensics on-demand on any compromised host and retrieve the forensics timeline upon successful collection.

Pack

IllusiveNetworks

Tasks

8

Inputs

• fqdn_or_ip — The host FQDN or IP address on which to collect forensics.
• start_date — The starting date of the forensics timeline.
• end_date — The last date of the forensics timeline.

Outputs

• Illusive.Forensics.Evidence.details — The forensics evidence details.
• Illusive.Forensics.Evidence.eventId — The event ID.
• Illusive.Forensics.Evidence.id — The forensics evidence ID.
• Illusive.Forensics.Evidence.source — The evidence source.
• Illusive.Forensics.Evidence.starred — Whether the forensics evidence has been starred.
• Illusive.Forensics.Evidence.time — Date and time of the forensics evidence.
• Illusive.Forensics.Evidence.title — The forensics evidence description.
• Illusive.Forensics.IncidentId — The incident ID.

Commands used

• illusive-get-event-incident-id
• illusive-get-forensics-timeline
• illusive-run-forensics-on-demand