5.8 KiB
Cyber Triage Evaluation Guide 3v10
Quick Start Evaluation Guide Version 3v10 This document was written to give you a quick overview of using Cyber Triage during your evaluation. Additional details can be found in the Cyber Triage User’s Guide, available at: https://docs.cybertriage.com. Evaluation License Limitations There are two ways to run Cyber Triage for an evaluation: ● If you have not evaluated it before, you can get a 7-day license that can ingest two hosts. To do this, simply launch Cyber Triage and choose Evaluation Mode. ● If you have previously evaluated before or your 7-day evaluation ended, you can get a longer license from the sales team (sales@cybertriage.com). This license will have the same capabilities as a paid license. Data Set Choices When you launch Cyber Triage in evaluation mode, you’ll be given two options:
- Use the provided Demo Data to get a basic understanding of the tool
- Import your own test data set Each of those options are covered below, but we recommend that you start with the demo data. 1 Copyright 2025 Sleuth Kit Labs, LLC
Demo Data The easiest way to get a basic understanding of Cyber Triage is to use our evaluation demo data, which has a mini intrusion scenario. Choose “Demo Data” from the previous dialog and Cyber Triage will then create an Incident and import the data set. You can then focus on looking at the analysis results. Once the demo data has been imported, Cyber Triage will display a dialogue prompting you to visit the website for training scenarios based on the demo data. NOTE: Once you have loaded data, you can go back to it by exiting from the evaluation dialog using the upper right X. Your Test Data The second option is to use your own data from a previous incident or test scenario. We recommend doing this after you have tried the evaluation demo data. Here are the basic steps:
-
Choose “Your Test Data” from the main menu and it will bring you to the panel below, which will allow you to import data using various options.
-
Choose one of the nine options presented (details below). 2 Copyright 2025 Sleuth Kit Labs, LLC
-
Configure malware analysis settings based on if you want to upload file content to ReversingLabs or not.
-
Review the results. How you get evaluation data into Cyber Triage depends on the type of data that you have. ● Cyber Triage File: Choose this if you want to manually launch the Cyber Triage Collector collection tool on a live system and have the results saved to a USB drive or network share. To do this, you will need to first copy the Collector to a USB drive or network share that the target system can access. o Use the “Extract Collector” button in the upper right of Cyber Triage to do this. Refer to the Collection Tool section of the User’s Guide on how to extract and configure the Collector. ● Disk Image: Choose this if you have a disk image that you want to analyze. o Supported disk image formats: ▪ Raw Image (*.img, .dd, .raw, .bin) ▪ Raw Split (.001, .aa) ▪ EnCase (.e01) ▪ Virtual Machine Disk (.vmdk) ▪ Virtual Hard Disk (.vhd, *.vhdx) 3 Copyright 2025 Sleuth Kit Labs, LLC
● KAPE: Choose this if you have a KAPE VHD or VHDX file that you’d like to import and analyze. Currently, only the VHD and VHDX files are analyzed, and other KAPE outputs are ignored. ● Network - PsExec: Choose this if you want to push the collection tool to a live system over the network using PsExec. This requires you to have a domain administrator account on the target system or that you have modified its registry. o Refer to the Configuring PsExec section for information on how to configure PsExec. ● Local Disk: Choose this method if you would like to analyze a local disc connected to the host machine. Note that because this disk is not an operating system, not all artifacts will be collected and analyzed. ● Linux UAC Files: Choose this if you have the output of the UAC collection tool from a Linux system. You need to use the ‘-p full’ option. NOTE: Cyber Triage will prompt you if you want to upload unknown files to ReversingLabs. By default, it will. An offline scanning option is available for air-gapped networks. More information on importing data into Cyber Triage can be found here: https://docs.cybertriage.com/en/latest/chapters/importing/host.html Analyzing the Data Once data starts to come into Cyber Triage, analysis will begin. We recommend you follow the steps as outlined in the top part of Cyber Triage 4 Copyright 2025 Sleuth Kit Labs, LLC
- Use the Summary panels to get a basic orientation of the system. What was found from automated analysis, what kind of users there are, etc.
- Next, go to the Review Notable items view to review items marked as “Bad” and “Suspicious”. You can change scores to “Bad” or “Unknown”.
- Lastly, you can go to Examine All Items to see all of the collected data. When reviewing data, you can use the bottom section to find data related to the item you are looking at. For example, if you selected a file on top, then the bottom will show you which processes are using that file and if there are startup items that refer to that file. You can also right click on an item to see it in full timeline or in a file structure. More information on analyzing data in Cyber Triage can be found here: https://docs.cybertriage.com/en/latest/chapters/analysis.htm Report Generation After your analysis completes, you can generate various HTML and JSON reports from the Dashboard. The HTML reports include detailed description of the threat items and a timeline of activity. The JSON reports can be imported into SIEMs and other data analytics systems. More information on generating reports can be found here: https://docs.cybertriage.com/en/latest/chapters/reports.html Thanks for trying Cyber Triage! The Cyber Triage Team Questions? Reach out to us at support@cybertriage.com 5 Copyright 2025 Sleuth Kit Labs, LLC