11. Advanced Configuration

Most environments do not need to make these changes, but they are available when needed.

11.1. Offline Environments

Cyber Triage can work in environments that are not connected to the Internet. This section contains some relevant features and settings.

11.1.1. Disable Internet Access

You can configure Cyber Triage to not connect to systems on the Internet and therefore not generate error messages. This setting is in the Options panel.

11.1.2. Offline Malware Scanning

You can still use the Cyber Triage^® Malware Scanning Service when you are on an air-gapped network.

After the collection has been fully analyzed, you can package up the file MD5 hashes into a text file.

• Press the Offline Malware link in the Analysis Tasks section of the Host Dashboard.

Status

• Choose to Export Hashes and pick a folder.

Offline Analysis

• That will produce a JSON text file with the hashes and license information.

• You can then copy that file to an Internet-connected computer and upload it to https://rep1.cybertriage.com.
  Copy and paste the text file into that page.

Reputation Service

• It will download another JSON file that you can then copy back into Cyber Triage^® and import using the same Offline Malware panel that you used to export the original set of hashes.

11.1.3. Local Copy of NSRL

Cyber Triage^® will use its Online Malware Scanning Service by default to assign a threat score to files. The service uses the NIST NSRL to identify files that ship with known applications (such as Microsoft Windows). If you are not using the online service, you can configure a local copy of the NIST NSRL.

The steps to do this include:

1. Download the NSRL index

2. Unzip the file

3. Open the Cyber Triage^® options panel, enable Use Local NSRL, and browse to where you unzipped the .idx file to.

Options (Use Local NSRL)

11.2. Configuring a Network Proxy

If you need to go through a corporate proxy to access the Internet, then Cyber Triage^® will need to be configured to use it for malware scanning. You can configure it in Options, Network Proxy.

You can choose between using the operating system settings for the proxy or to manually enter a proxy. Make sure you press the button to test the connection. Depending on your environment, you may be prompted to accept an SSL certificate that your proxy uses.

SSL Certificate Information

11.3. Changing Port Number

Cyber Triage^® will open TCP port 443 so that the Collector can send data to it over the network. If you have another application that is using that port, then you can configure Cyber Triage^® to us a different one by going to the Options panel and choosing the Network Settings tab.

Options (Network Settings)

If you change the port number, you will need to explicitly specify this port number when you manually run the Collector.

11.4. Changing Where Data is Stored

Cyber Triage^® uses a “data folder” to store databases, collected file contents, logs and other data. The default location is a ‘cybertriage’ folder in the user’s local AppData folder.

The folder can be quite large, especially as more data is added into Cyber Triage.

You can move this folder to a new location. Note that it is your responsibility to move the existing contents to the new location.

Standard Version:

1. Launch the options panel and choose General → Data Folder.

2. Pick a new folder.

3. Shutdown Cyber Triage

4. Copy the contents of %LOCALAPPDATA%\cybertriage to the new location.

5. Restart Cyber Triage and verify you can open past cases.

Team Version:

1. Shut down Cyber Triage Team Server

2. Open up %appdata%\cybertriage\config\v3\config.yml in a text editor.

3. Change “contentDirectoryPath” to the new path (ex. C:\new\path\cybertriage)

4. Change “uploadFilePath” to the new path (ex. C:\new\path\cybertriage\files\CyberTriage\)

5. Save config.yml

6. Copy the contents of %LOCALAPPDATA%\cybertriage\ to the new location.

7. Start up Cyber Triage Team Server