MISFIT/Cyber Triage Evaluation Guide_3v10_pdf.md

# Cyber Triage Evaluation Guide 3v10


---

Quick Start Evaluation Guide
Version 3v10
This document was written to give you a quick overview of using Cyber Triage during your
evaluation. Additional details can be found in the Cyber Triage User’s Guide, available at:
https://docs.cybertriage.com.
Evaluation License Limitations
There are two ways to run Cyber Triage for an evaluation:
● If you have not evaluated it before, you can get a 7-day license that can ingest two
hosts. To do this, simply launch Cyber Triage and choose Evaluation Mode.
● If you have previously evaluated before or your 7-day evaluation ended, you can get a
longer license from the sales team (sales@cybertriage.com). This license will have the
same capabilities as a paid license.
Data Set Choices
When you launch Cyber Triage in evaluation mode, you’ll be given two options:
1. Use the provided Demo Data to get a basic understanding of the tool
2. Import your own test data set
Each of those options are covered below, but we recommend that you start with the demo data.
1
Copyright 2025 Sleuth Kit Labs, LLC

Demo Data
The easiest way to get a basic understanding of Cyber Triage is to use our evaluation demo
data, which has a mini intrusion scenario.
Choose “Demo Data” from the previous dialog and Cyber Triage will then create an Incident and
import the data set. You can then focus on looking at the analysis results.
Once the demo data has been imported, Cyber Triage will display a dialogue prompting you to
visit the website for training scenarios based on the demo data.
NOTE: Once you have loaded data, you can go back to it by exiting from the evaluation dialog
using the upper right X.
Your Test Data
The second option is to use your own data from a previous incident or test scenario. We
recommend doing this after you have tried the evaluation demo data.
Here are the basic steps:
1. Choose “Your Test Data” from the main menu and it will bring you to the panel below,
which will allow you to import data using various options.
2. Choose one of the nine options presented (details below).
2
Copyright 2025 Sleuth Kit Labs, LLC

3. Configure malware analysis settings based on if you want to upload file content to
ReversingLabs or not.
4. Review the results.
How you get evaluation data into Cyber Triage depends on the type of data that you have.
● Cyber Triage File: Choose this if you want to manually launch the Cyber Triage
Collector collection tool on a live system and have the results saved to a USB drive or
network share. To do this, you will need to first copy the Collector to a USB drive or
network share that the target system can access.
o Use the “Extract Collector” button in the upper right of Cyber Triage to do this.
Refer to the Collection Tool section of the User’s Guide on how to extract and
configure the Collector.
● Disk Image: Choose this if you have a disk image that you want to analyze.
o Supported disk image formats:
▪ Raw Image (*.img, *.dd, *.raw, *.bin)
▪ Raw Split (*.001, *.aa)
▪ EnCase (*.e01)
▪ Virtual Machine Disk (*.vmdk)
▪ Virtual Hard Disk (*.vhd, *.vhdx)
3
Copyright 2025 Sleuth Kit Labs, LLC

● KAPE: Choose this if you have a KAPE VHD or VHDX file that you’d like to import and
analyze. Currently, only the VHD and VHDX files are analyzed, and other KAPE outputs
are ignored.
● Network - PsExec: Choose this if you want to push the collection tool to a live system
over the network using PsExec. This requires you to have a domain administrator
account on the target system or that you have modified its registry.
o Refer to the Configuring PsExec section for information on how to configure
PsExec.
● Local Disk: Choose this method if you would like to analyze a local disc connected to
the host machine. Note that because this disk is not an operating system, not all artifacts
will be collected and analyzed.
● Linux UAC Files: Choose this if you have the output of the UAC collection tool from a
Linux system. You need to use the ‘-p full’ option.
NOTE: Cyber Triage will prompt you if you want to upload unknown files to ReversingLabs. By
default, it will. An offline scanning option is available for air-gapped networks.
More information on importing data into Cyber Triage can be found here:
https://docs.cybertriage.com/en/latest/chapters/importing/host.html
Analyzing the Data
Once data starts to come into Cyber Triage, analysis will begin. We recommend you follow the
steps as outlined in the top part of Cyber Triage
4
Copyright 2025 Sleuth Kit Labs, LLC

1. Use the Summary panels to get a basic orientation of the system. What was found from
automated analysis, what kind of users there are, etc.
2. Next, go to the Review Notable items view to review items marked as “Bad” and
“Suspicious”. You can change scores to “Bad” or “Unknown”.
3. Lastly, you can go to Examine All Items to see all of the collected data.
When reviewing data, you can use the bottom section to find data related to the item you are
looking at. For example, if you selected a file on top, then the bottom will show you which
processes are using that file and if there are startup items that refer to that file.
You can also right click on an item to see it in full timeline or in a file structure.
More information on analyzing data in Cyber Triage can be found here:
https://docs.cybertriage.com/en/latest/chapters/analysis.htm
Report Generation
After your analysis completes, you can generate various HTML and JSON reports from the
Dashboard. The HTML reports include detailed description of the threat items and a timeline of
activity. The JSON reports can be imported into SIEMs and other data analytics systems.
More information on generating reports can be found here:
https://docs.cybertriage.com/en/latest/chapters/reports.html
Thanks for trying Cyber Triage!
The Cyber Triage Team
Questions? Reach out to us at support@cybertriage.com
5
Copyright 2025 Sleuth Kit Labs, LLC