Add markdown exports

Cyber Triage Evaluation Guide_3v10_pdf.md

@@ -0,0 +1,110 @@
+# Cyber Triage Evaluation Guide 3v10
+
+
+---
+
+Quick Start Evaluation Guide
+Version 3v10
+This document was written to give you a quick overview of using Cyber Triage during your
+evaluation. Additional details can be found in the Cyber Triage User’s Guide, available at:
+https://docs.cybertriage.com.
+Evaluation License Limitations
+There are two ways to run Cyber Triage for an evaluation:
+● If you have not evaluated it before, you can get a 7-day license that can ingest two
+hosts. To do this, simply launch Cyber Triage and choose Evaluation Mode.
+● If you have previously evaluated before or your 7-day evaluation ended, you can get a
+longer license from the sales team (sales@cybertriage.com). This license will have the
+same capabilities as a paid license.
+Data Set Choices
+When you launch Cyber Triage in evaluation mode, you’ll be given two options:
+1. Use the provided Demo Data to get a basic understanding of the tool
+2. Import your own test data set
+Each of those options are covered below, but we recommend that you start with the demo data.
+1
+Copyright 2025 Sleuth Kit Labs, LLC
+
+Demo Data
+The easiest way to get a basic understanding of Cyber Triage is to use our evaluation demo
+data, which has a mini intrusion scenario.
+Choose “Demo Data” from the previous dialog and Cyber Triage will then create an Incident and
+import the data set. You can then focus on looking at the analysis results.
+Once the demo data has been imported, Cyber Triage will display a dialogue prompting you to
+visit the website for training scenarios based on the demo data.
+NOTE: Once you have loaded data, you can go back to it by exiting from the evaluation dialog
+using the upper right X.
+Your Test Data
+The second option is to use your own data from a previous incident or test scenario. We
+recommend doing this after you have tried the evaluation demo data.
+Here are the basic steps:
+1. Choose “Your Test Data” from the main menu and it will bring you to the panel below,
+which will allow you to import data using various options.
+2. Choose one of the nine options presented (details below).
+2
+Copyright 2025 Sleuth Kit Labs, LLC
+
+3. Configure malware analysis settings based on if you want to upload file content to
+ReversingLabs or not.
+4. Review the results.
+How you get evaluation data into Cyber Triage depends on the type of data that you have.
+● Cyber Triage File: Choose this if you want to manually launch the Cyber Triage
+Collector collection tool on a live system and have the results saved to a USB drive or
+network share. To do this, you will need to first copy the Collector to a USB drive or
+network share that the target system can access.
+o Use the “Extract Collector” button in the upper right of Cyber Triage to do this.
+Refer to the Collection Tool section of the User’s Guide on how to extract and
+configure the Collector.
+● Disk Image: Choose this if you have a disk image that you want to analyze.
+o Supported disk image formats:
+▪ Raw Image (*.img, *.dd, *.raw, *.bin)
+▪ Raw Split (*.001, *.aa)
+▪ EnCase (*.e01)
+▪ Virtual Machine Disk (*.vmdk)
+▪ Virtual Hard Disk (*.vhd, *.vhdx)
+3
+Copyright 2025 Sleuth Kit Labs, LLC
+
+● KAPE: Choose this if you have a KAPE VHD or VHDX file that you’d like to import and
+analyze. Currently, only the VHD and VHDX files are analyzed, and other KAPE outputs
+are ignored.
+● Network - PsExec: Choose this if you want to push the collection tool to a live system
+over the network using PsExec. This requires you to have a domain administrator
+account on the target system or that you have modified its registry.
+o Refer to the Configuring PsExec section for information on how to configure
+PsExec.
+● Local Disk: Choose this method if you would like to analyze a local disc connected to
+the host machine. Note that because this disk is not an operating system, not all artifacts
+will be collected and analyzed.
+● Linux UAC Files: Choose this if you have the output of the UAC collection tool from a
+Linux system. You need to use the ‘-p full’ option.
+NOTE: Cyber Triage will prompt you if you want to upload unknown files to ReversingLabs. By
+default, it will. An offline scanning option is available for air-gapped networks.
+More information on importing data into Cyber Triage can be found here:
+https://docs.cybertriage.com/en/latest/chapters/importing/host.html
+Analyzing the Data
+Once data starts to come into Cyber Triage, analysis will begin. We recommend you follow the
+steps as outlined in the top part of Cyber Triage
+4
+Copyright 2025 Sleuth Kit Labs, LLC
+
+1. Use the Summary panels to get a basic orientation of the system. What was found from
+automated analysis, what kind of users there are, etc.
+2. Next, go to the Review Notable items view to review items marked as “Bad” and
+“Suspicious”. You can change scores to “Bad” or “Unknown”.
+3. Lastly, you can go to Examine All Items to see all of the collected data.
+When reviewing data, you can use the bottom section to find data related to the item you are
+looking at. For example, if you selected a file on top, then the bottom will show you which
+processes are using that file and if there are startup items that refer to that file.
+You can also right click on an item to see it in full timeline or in a file structure.
+More information on analyzing data in Cyber Triage can be found here:
+https://docs.cybertriage.com/en/latest/chapters/analysis.htm
+Report Generation
+After your analysis completes, you can generate various HTML and JSON reports from the
+Dashboard. The HTML reports include detailed description of the threat items and a timeline of
+activity. The JSON reports can be imported into SIEMs and other data analytics systems.
+More information on generating reports can be found here:
+https://docs.cybertriage.com/en/latest/chapters/reports.html
+Thanks for trying Cyber Triage!
+The Cyber Triage Team
+Questions? Reach out to us at support@cybertriage.com
+5
+Copyright 2025 Sleuth Kit Labs, LLC