meta data for this page
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| soc:tools:start [2026/06/10 14:41] – titannet | soc:tools:start [2026/06/11 12:23] (current) – titannet | ||
|---|---|---|---|
| Line 6: | Line 6: | ||
| * [[kibana]] | * [[kibana]] | ||
| * [[splunk]] | * [[splunk]] | ||
| - | |||
| ===== Network ===== | ===== Network ===== | ||
| - | [[wireshark]] | + | * [[wireshark]] |
| Line 17: | Line 16: | ||
| ===== IR ===== | ===== IR ===== | ||
| - | * [[x-ways]] | + | * [[velociraptor]] |
| + | * remote artefact collection and administration | ||
| + | * [[iris]] | ||
| + | * Collaborative Incident Response Platform | ||
| + | * [[x_ways]] | ||
| * [[axiom]] | * [[axiom]] | ||
| - | * [[f-Response]] | + | * [[f_Response]] |
| * [[arsenal_image_mounter]] | * [[arsenal_image_mounter]] | ||
| * [[magnet_ram_capture]] | * [[magnet_ram_capture]] | ||
| Line 57: | Line 60: | ||
| * TZWorks, USB parser | * TZWorks, USB parser | ||
| * [[sysinternals]] | * [[sysinternals]] | ||
| + | * tcpview, resmon, | ||
| Line 86: | Line 90: | ||
| * [[volatility]] | * [[volatility]] | ||
| + | |||
| + | |||
| + | ==== Triage ==== | ||
| + | |||
| + | * [[cylr] | ||
| + | * [[https:// | ||
| + | |||
| + | |||
| + | ==== Disks ==== | ||
| + | |||
| + | * [[dd]], ddc3dd, ddrescue | ||
| + | * [[ewfaquire]] | ||
| + | * [[guymager]] | ||
| + | * [[ftk_imager]] | ||
| + | |||
| + | |||
| + | |||
| + | |||
| ==== Forensics ==== | ==== Forensics ==== | ||
| - | * | + | |