5. Integrations

Cyber Triage can integrate with several platforms. This page provides links to the instructions for using them.

5.1. Deploy via EDR / Agents

You can use EDRs and other agent-based systems to deploy the Cyber Triage Collector. Our Collector is very easy to deploy. It’s a single Windows executable.

The agents from an EDR or other tool (such as Velociraptor) can be used to copy the Collector to the endpoint and to launch it.

5.2. Import Telemetry

You can import telemetry data from EDRs. This feature requires a special license.

5.3. GenAI Clients

GenAI clients can connect using a STDIO MCP server.

5.4. Cloud Storage

This section contains our advice on creating buckets and accounts for cloud storage. The Cyber Triage application does not do this for you. Make sure whatever you do complies with your organization’s policies.

After you complete these steps, refer to Configure Cloud Storage Profiles to add the users and bucket information into the Cyber Triage application.

Cyber Triage can use cloud storage to store data before it is imported into the main application for analysis. The basic process is:

  • Configure a single bucket with at least two types of accounts that can access it. Those details are in the pages below.

  • When the Cyber Triage Collector is run on a live system, it uploads the data to the configured bucket.

    • The file is first saved locally, so ensure you have enough disk space.

    • The data is broken up into chunks (often < 2GB) before uploading.

    • Each file has a unique name based on the host name and timestamp. So, multiple hosts can upload into the same bucket without getting a collision.

  • You can then analyze them with Cyber Triage using the “Cyber Triage File” import feature. This feature allows you to directly read from the cloud storage bucket.

Cyber Triage supports uploading and downloading collections to S3-compatible (AWS, Backblaze, etc.) and Microsoft Azure cloud storage services. In order to improve security we recommend having at least three different accounts:

  • An administrator account that can create buckets, identities, etc. This account should be the most protected. You will never need to enter this account into Cyber Triage.

  • A Collector Upload account that should only have write permissions to the bucket/container that Cyber Triage uses. This account is the one that could be compromised by an attacker since it will be used on a potentially compromised computer.

  • A Manager account that can download files from the bucket and list the contents of the bucket. This is optional and will be used by the Cyber Triage application to process files that are in the bucket.

The rest of this section outlines how to use the administrator account and the service provider’s web console to create them.

5.5. Cloud Function Triggers

You can create cloud functions, such as AWS Lambdas or Azure Functions, to start automatically processing.

5.6. SIEMs

Cyber Triage can export data that can be imported into Splunk (see All Items JSON Report).

5.7. Case Management

The results from an investigation can be pushed back into case management software:

5.8. Other Forensics Tools

The output of Cyber Triage can be imported into other tools, such as:

5.9. Scripts

You can invoke Cyber Triage from your own scripts using its command line interface.