3.3.3. Collector Output

3.3.3.1. What is it

The Cyber Triage Collector method will import data from the Cyber Triage Collector.

Watch the Cyber Triage Basics Course videos on this approach:

3.3.3.2. How to Get The Data

To use this feature, you need to:

  • Launch the Collector using one of the various methods and have it save to a local or cloud storage file (see How Can You Launch It)

  • Copy the file to your Cyber Triage computer if it is not in cloud storage. Make sure you copy all of the files if the output was split (i.e. .002, .003, etc.).

Warning

If using USB on target devices, it is important to have AutoRun disabled on the computer running Cyber Triage® so that it does not get infected by malware that spreads by USB devices.

3.3.3.3. Where To Put Your Data

The following locations are supported based on your access method:

Application

Supported Locations

Standard

Locally accessible or cloud storage

Team, Web Client

Local (single host only), Server accessible, or cloud storage

Team, Local Client

Local, Server accessible, or cloud storage

You can add multiple hosts in one step if they are in the same LOCAL folder:

  • All files in the folder will be added (even those that were already added)

  • Subfolders are examined. For example, you could add C:\incident1` and have two JSONs at:

    • C:\incident1\host1\file.JSON.gz

    • C:\incident1\host2\file.JSON.gz

  • Server Accessible Data Source Folder

  • Team Local Client

3.3.3.4. How to Import

To add one or more Cyber Triage Collector JSON files, choose Add New Host from the Incident Overview and choose the Cyber Triage File box.

../../_images/import_ctfile_panel.png

Cyber Triage File

You will also have the ability to supply a password that was used to encrypt the file (this is not needed if you used public key encryption).

  1. Choose:

    • “File Location”

    • “Host Count”

  2. Browse to pick the data to add:

  • A single, local host

  • A folder containing multiple local hosts

../../_images/import_multi_host_files_count.jpg

  • Server accessible

../../_images/import_ctfile_server_browse.png

  • Cloud

../../_images/import_ctfile_cloud_browse.png

  1. Update the display name and reference date as needed.

  2. Press Continue and refer to Ingest-Time Settings for configuring malware settings