2.3. Setup (Standard and Team)

This section outlines the basics of the UI and various settings that you may need to change before adding data. Configuration of a Team infrastructure is covered in Team Installation and Configuration.

In many cases, you can use Cyber Triage with no additional configuration. But, this section provides an overview of things to consider. Each bullet below points to where that setting is actually documented.

Collection settings:

• Custom File Collection Rules: If you plan to customize the files that the Collector will collect, then refer to Customize File Collection.

• Cloud Storage: If you plan to have the Collector upload to cloud storage (S3-compatible or Azure), then refer to Configure Cloud Storage Profiles.

• Encryption: If you want to have the Collector encrypt its output using a public key that can only be decrypted by your system, then refer to Configure Collector Output Encryption.

• PsExec: If you plan to use the “Network - PsExec” feature of Cyber Triage that allows you to copy over the collection tool via PsExec, then refer to Configuring PsExec.

• EDR Telemetry: If you plan to import telemetry directly from an EDR using its API, then refer to Microsoft Defender or SentinelOne.

Analysis Settings:

• Yara: If you want to use your own Yara rules or edit the Good / Bad lists, then refer to Configure Yara Signatures or Configure Bad and Good Lists.

• Baseline: If you want to have a gold image whose contents will not get scored as bad or suspicious, then refer to Configure Baselines (Gold Images).

Network Settings:

• Firewalls: If your network restricts traffic based on destinations and ports, then refer to Listening Ports for details on what Cyber Triage needs.

• Proxy: If you have a TLS intercept proxy, then you need to configure Cyber Triage so that it validates that certificate. Refer to Configure Internal Intercept Proxies.

Storage Settings:

• Data Folder: If you want to move where Cyber Triage stores its data, refer to Changing Where Data is Stored.