3.3. Adding a Host

There are four basic steps to add data:

• Ensure your threat intelligence is up to date (see Update Threat Intelligence)

• Press “Add Host” from Incident Overview and pick the type of data to add

• Specify the location of the data

• Specify how to analyze the data (see Ingest-Time Settings).

There are basic concepts that apply to all of the methods:

• Specifying An Incident Reference Date

• Queueing Up Data

• Location of Processing in a Team Deployment

The “Add Host” wizard organizes the methods for adding data into three tabs.

• Recently Used

• Import Existing Dataset

• Start Live Collection

Importing Existing Data

These methods import data you’ve already collected using the Collector or another tool.

Add New Host - Import Existing Dataset tab

• DFIR Collections: Output from tools that collect a subset of the files on a host

  • Collector Output

  • KAPE Output

  • Linux UAC Output

  • Logical Files

• Telemetry: Data collected from EDRs and other continuous monitoring solutions

  • SentinelOne Telemetry

  • Microsoft Defender Telemetry

• Full Images: Output from full imagers

  • Disk Image

  • Memory Image

  • Local Disk

Start Live Collection

These methods collect data using the Cyber Triage Collector.

Add New Host - Start Live Collection tab

• Launching The Collector Manually (Interactive Session)

• Launch via EDR (EDR Agents)

• Network - PsExec

• Network - Manual

• Launch via PowerShell, WMI, etc. (PowerShell / WMI)