meta data for this page
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| soc:tools:start [2026/06/10 12:32] – titannet | soc:tools:start [2026/06/10 15:04] (current) – titannet | ||
|---|---|---|---|
| Line 4: | Line 4: | ||
| ===== SIEM ===== | ===== SIEM ===== | ||
| - | [[kibana]] | + | * [[kibana]] |
| - | [[splunk]] | + | |
| ===== Network ===== | ===== Network ===== | ||
| - | [[wireshark]] | + | * [[wireshark]] |
| - | ===== Forensics | + | ===== IR ===== |
| + | |||
| + | * [[velociraptor]] | ||
| + | * remote artefact collection and administration | ||
| + | * [[iris]] | ||
| + | * Collaborative Incident Response Platform | ||
| + | * [[x_ways]] | ||
| + | * [[axiom]] | ||
| + | * [[f_Response]] | ||
| + | * [[arsenal_image_mounter]] | ||
| + | * [[magnet_ram_capture]] | ||
| + | * [[exiftool]] | ||
| + | * [[sqlite_database_browser]] | ||
| + | * [[ost_pst_viewer]] | ||
| + | * [[registry_viewer]] | ||
| + | * [[regripper]] | ||
| + | * [[ghidra]] | ||
| + | |||
| + | ===== Commandline ===== | ||
| + | |||
| + | |||
| + | * [[evtwalk]] | ||
| + | * Parse Windows Event Logs | ||
| + | |||
| + | |||
| + | * [[dissect]] | ||
| + | * Analysis of file systems and images | ||
| + | * [[timelines] | ||
| + | * tools like [[plaso]], [[log2timeline]], | ||
| + | * [[hayabusa]] | ||
| + | * Parses windows event logs or sysmon/ | ||
| + | |||
| + | |||
| + | ===== Windows GUI ===== | ||
| + | |||
| + | * [[memprocfs]] | ||
| + | |||
| + | * [[wireshark]] | ||
| + | * [[networkminer]] | ||
| + | * [[snort]] | ||
| + | * [[zeek]] | ||
| + | * [[yaru]] | ||
| + | * TZworks, yet another registry utility | ||
| + | * [[usp]] | ||
| + | * TZWorks, USB parser | ||
| + | * [[sysinternals]] | ||
| + | * tcpview, resmon, | ||
| + | |||
| + | |||
| + | ===== Malware Analysis ===== | ||
| + | |||
| + | * [[https:// | ||
| + | * [[https:// | ||
| + | * [[https:// | ||
| + | * [[https:// | ||
| + | |||
| + | |||
| + | ==== Data Collection ==== | ||
| + | |||
| + | * [[CyLR]] | ||
| + | * Collect artefacts on Win, Linux and MacOS | ||
| + | * [[UAC]] | ||
| + | * Unix Artefacts Collector | ||
| + | * [[ntfswalk]] | ||
| + | * ntfswalk, gena (gui) | ||
| + | * Scripts | ||
| + | |||
| + | |||
| + | ==== Active Directory ==== | ||
| + | |||
| + | * [[ping_castle]] | ||
| ==== Memory ==== | ==== Memory ==== | ||
| - | [[volatility]] | + | * [[volatility]] |
| + | |||
| + | ==== Forensics ==== | ||
| + | |||
| + | |||
| + | * | ||