3.5.2. Host-level Examination
Once you have added data to Cyber Triage® and automated analysis has started, then your goal will be to review the results. Cyber Triage will assist you as much as possible to find all evidence.
The assisted examination process can start while the artifacts are still being analyzed. Some teams choose to wait until the end. Others start right away.
Your main goal is to review the notable scored items, udpate the score as appropriate, and find additional evidence. Refer to Scores and Labels for a review of the scoring concepts and had to change scores.
3.5.2.1. Basic Workflow
As previously outlined, we recommend four phases of investigating a host:
Get a quick overview of the system. This is the ‘Overview’ part of the Cyber Triage UI. See Overview Section.
Review what Cyber Triage scored as Bad and Suspicious and correct the scores. This is the ‘Review Notable Items’ part. See Review Notable Items Section.
Dive into individual artifacts if you need to. This is the “Review All Items” part of the UI. See Examine All Items Section
Generate reports for human or machines to use. You can also generate reports at the incident-level when all of the hosts are complete.
The first time you open a host, you’ll see a dialog that walks through this workflow:
You’ll also see this flow in the top of the UI once you open a host.
3.5.2.2. Overview Section
The goal of the Overview Section is for you to get an understanding of the host you are looking at. Every investigation is of course different, but the intention is that you spend five minutes or less here. You can dive into the details later.
The goal of the Overview tab is to give you a bit of everything about the host in one place, so you can spend a minute or two familiarizing yourself with it right when you open it. There is no longer a separate left-hand menu for overview-level information - the old Host, Process, and Logon Overview panels now all live here, with a reduced amount of data on each.
At the top of the Overview tab, you’ll see the analysis status and Notable Items counts, along with a GenAI Summary (created once ingest completes) that gives a written narrative of the likely incident, endpoint triage categories, and key events:
The Status panel also has buttons for Job Details, Restart Analysis, Sandbox Results, Malware Scan Details, and Offline Malware.
Below the Status panel are two more panels that give you a quick understanding of the host:
System Overview: Host Name, OS Product Name, OS Version, Adapter IP Address, OS Install Date, System Boot Time, and Drive Encryption status, with Host Details and Collection Details buttons.
Typical Activity: based on the last 30 days of activity, shows Regular Users, the Local vs. Remote split of Inbound Logons, Failed Logons, and frequent non-standard Processes (with their run counts).
System Overview and Typical Activity panels
The second set of views is about the collection and analysis pipelines. You won’t learn about specific artifacts here, but they give you an overview of the analysis:
Analysis Jobs: This will show you what analysis is still ongoing. You can cancel jobs from here.
- Collection Information: This will show you how the data was collected and what was collected. Access this by pressing the Collection Details button in the System Overview panel (above).
The “Source Files” section will list all files that were attempted to be collected (even if they didn’t exist). The Status column will show you if it was attempted and found. You can export all of the collected files with the “Export All Collected Source Files” option.
Data Issues: This will show you any errors associated with the collection or processing of the data.
3.5.2.3. Review Notable Items Section
Once you have used the Overview section to get an understanding of the system, you should move to the “Review Notable Items section. The goals of this section are to:
Confirm if the automatically scored Bad and Suspicious items are Bad or if they were false positives
Get an understanding of the sequence of events. This data is displayed in a timeline view.
You may spend most of your investigation time in this section.
Selecting an item shows its details in the item detail panel on the right, with quick links to view it in the Bad Items Timeline or open the The Item Inspector for a deeper look.
By default, you will see all items scored as Bad and Suspicious, sorted by time with the oldest items first. The suggested process is to:
- Go down the list and review each item.
If it’s an obvious false positive, then change the score to “Unknown” or “Good”. If you known it is Good, you can also optionally add it to the “Good List” using the “…” (more actions) menu.
If it was scored as suspicious and is obviously bad, then change it’s score to “Bad”.
If it’s not obvious, then skip it and come back to it.
After doing a first pass on all of the automatically scored items, then revisit each of the more complicated ones and make decisions about them. Change their score appropriately.
You can of course fully analyze each item before moving on to the next. We suggest the breadth-first approach to first get a full understanding of what was found.
Your goal is to change all of the suspicious items to Bad, Good, or Unknown.
For endpoint triage, we recommend:
Focus on the Last 7 days using the time range drop-down.
First, filter to just Bad items using the count box and make sure you understand them.
Then bring in Suspicious items and go down the list from oldest to newest, updating scores as you decide if they are Bad or not.
There are several ways to filter the table down to focus on specific types of items:
Use the time range drop-down to narrow to the Last 7/14/30 days (it defaults to All time, but your selection is persisted). If the incident is recent, focusing on the most recent days can help you find relevant items faster.
Press the Filters button above the table.
Select the Bad or Suspicious count box to filter by score.
Click a bar in the Histogram tab to filter to items from that day.
Select a tactic in the ATT&CK tab to filter to items associated with it.
Select a category in the Result Types tab to filter to items with that result.
3.5.2.4. Further Investigating An Item
When you want to better understand an item, there are several techniques you can use:
Review associated items using the bottom “Related Items” viewers
Submit executables for sandbox analysis
Export files for 3rd party analysis
3.5.2.4.1. The Item Inspector
The Item Inspector is new in v4. It lets you jump from a table of items into the full details of a single artifact, and then pivot to related items from there, without losing your place in the original table.
For example, if you are in the Notable Items panel and need to examine a Triggered Task, select it and press Item Inspector under “View in:” at the top of the item detail panel on the right (next to Bad Items Timeline). The Item Inspector opens as an overlay on top of your current view, so your original table isn’t disrupted.
Opening the Item Inspector from the item detail panel
Instead of the bottom tabs used in earlier versions, the Item Inspector has a left-hand navigation. The exact sections shown depend on the item’s type, but generally include:
Overview
GenAI Enrichment: AI-generated context about the item (new in v4)
Content: a preview of the file’s contents (file items only)
Bad Items Timeline
Scores
Other Occurrences: other hosts and incidents that have the same item, both fuzzy and exact match
Sources: the underlying data artifacts that produced this item’s data
Related items: a group of type-specific sections for items connected to this one - for example, a Triggered Task shows Files, Triggered Tasks, and Processes; a File shows Accounts, Triggered Tasks, and Processes
Item Inspector Overview, with the left-hand navigation
3.5.2.4.1.1. Pivoting Between Items
From a Related items section, select a row and press Open to pivot into that item - for example, from a Triggered Task to the file it runs.
Opening a related file from the Triggered Task’s Files section
The Item Inspector loads that item on top of the previous one, like a stack, and the breadcrumb at the top updates to show every item in the chain (e.g. “Triggered Task: powershell.exe > File: powershell.exe”). You can keep pivoting as many times as you need, such as from the file to its user or to other processes.
Breadcrumb after pivoting from the Triggered Task to its file
When you’re done, you can change the current item’s score using the Score As button in the upper right, then press Close to return to exactly where you started, such as the Notable Items view.
Score As and Close, after pivoting twice (Triggered Task > File > Process)
3.5.2.4.2. Bad Items Timeline
In earlier versions, the Bad Items Timeline was always visible on the right side of the All Items view. In v4, it’s instead available on demand via a Bad Items Timeline button at the top of the item detail (Summary) panel, or from within the Item Inspector.
Pressing it opens an overlay showing up to 25 Bad Items before and after your selected item, which is automatically inserted into its place in the sequence so you can see where it fits relative to the known attack timeline. An Include all hosts checkbox controls whether it shows Bad Items from every host in the incident or just the current one.
Bad Items Timeline overlay, with the time gap to the next event called out
There are three differences from the old, always-visible version:
The selected item is automatically inserted into the list instead of you needing to figure out where it fits.
It shows items from all hosts in the incident, not just the current one.
It shows the time gaps between events, so you don’t have to calculate them yourself.
3.5.2.4.3. Upload for Sandbox Analysis from Recorded Future
If you have a suspicious executable or document, you can also upload it to the Recorded Future Sandbox so that you can get dynamic analysis. The file will be run on a remote system (managed by Recorded Future) and you will get a report of what processes were created, files opened, etc.
Note
Any file submitted to Recorded Future for analysis will not be available to the public and will remain in the Cyber Triage® Recorded Future enclave.
To use this feature, either:
Click the “…” (more actions) icon on a file row, choose “Analyze for Malware”, then “Upload to Recorded Future Sandbox”
Choose Analyze for Malware, then Upload to Recorded Future Sandbox
Or, with the item selected, go to the Content section of the item detail panel on the right and press Upload under “Sandbox Analysis (Recorded Future)”
Uploading from the Content section of the item detail panel
Agree to the Recorded Future Sandbox Privacy Agreement
Wait a few minutes for the program to run in their controlled environment
Check the Job Details button in the Status panel to confirm “Sandbox Analysis” has completed.
Job Details showing Sandbox Analysis completed
Then go to the All Items tab and choose Sandbox Results from the left-hand navigation. Select a file to see its behavior analysis.
Sandbox Results list (left) and Recorded Future report (right)
Press View the Original Report to see the full report directly from Recorded Future.
3.5.2.4.4. Upload File Content for Malware Analysis
If you chose to not upload content for malware analysis during automated analysis, you can later upload specific files by right clicking on them and choosing “Upload to CyberTriage.com”.
Once the results come back, the score will automatically change.
3.5.2.4.5. Export Files
You may want to export files from Cyber Triage so that you can share them or analyze them in other tools. You have two ways of doing this depending on what kind of file it is.
If you want to extract a single file or folder that you found from one of the data types or file explorer, you can do this from either the “…” menu or the item detail panel:
From the “…” menu, choose Export File, then Raw File or ZIP File.
Export File from the “…” menu
Or, with the item selected, use the Export button in the Content section of the item detail panel on the right.
Export from the Content section of the item detail panel
The “Raw File” option will save the file in its original form. The “ZIP File” option will place the file into a ZIP file with the password “infected” (without the quotes). The ZIP file is useful to prevent malware from being quarantined or deleted.
If you want to export all source files (such as registry hives, event logs, prefetch files, etc.), then go to the Overview tab and press Collection Details in the System Overview panel. See Overview Section.
3.5.2.5. Examine All Items Section
Lastly, you can review all of the artifacts, not just the ones that were scored as suspicious or bad. You can do this in the “Examine All Items” section. Sometimes, you may not even need to come in this section if enough was found from the automated analysis.
By default, items scored as Good are hidden from all of the “All Items” views below. This can be changed with the All Items Filter setting in the General section of the Options panel.
The information artifact types on the left hand side are organized by user-oriented data and process-oriented data.
3.5.2.5.1. Accounts
The Accounts menu item shows all local and domain user accounts that either:
Have accounts on the host
Logged into the host
Are referenced in log files
This means that depending on the filter settings, you will see accounts that did not log into the system. You can use the filters to focus in on different types of users.
Note
Not all data will be available for all users in this view because some data exists only for local accounts and other data is from logs that roll over.
Accounts Interface
What Should You Do: Review the accounts to identify those with an abnormal naming convention, in appropriate permissions, or creation times that are similar to the incident timing.
The following filters exist in this view:
Show all bad and suspicious items: This option will show only accounts that have been scored as suspicious or bad.
- Account Type: Select what types of accounts to include in the view:
Regular: Accounts that currently exist on the system. Pulled from SAM and Software hives.
Service: A Windows service account
Limited: A Windows limited access user account, such as Guest.
Unknown: Accounts for which a reference was found (either by SID or user name), but do not map back to registry data for a Regular, Service, or Limited account. This can be a deleted “regular” account or a reference to a user that may not even exist on the system, such as the destination user for an outgoing logon session.
Active Time: Date range that the user had activity
- Observed Actions: Select what kind of activity that the account must have:
Process or interactive logon: Accounts for which there is evidence that the user had a local or remote interactive login with the system or launched a process (locally or remotely) on the system.
File or service access: Accounts for which there is evidence that the user interacted with a file or service on the system. Examples include accessing a file share or owning a file that got copied to the system.
No observed actions: Accounts where there was a reference to the user on the system, perhaps in an event log or registry, but no evidence was found of them doing anything on this specific system. Examples include accounts that were created and never used or entries in a log server.
- Hide accounts: Select what kinds of accounts that you do not want to view, often because they are not typically interesting during an intrusion:
Disabled: Accounts that are not active (and therefore can’t be used).
Non-existent: Incorrect user names that were used for attempted logons.
System or virtual: Accounts that are created by the OS (such as ‘Font Driver Host/DWM-1’).
Non-admin: Accounts that have normal user access.
Domain controllers require special attention if you want to know who logged into it because every user in the domain will have some kind of reference on it (from accessing a file share or using the controller for authentication). Filter on accounts that had Interactive Actions to focus on the accounts that logged in.
3.5.2.5.2. Inbound Logons
Note
As of version 3.4.0, the “Logins” section has been replaced by the new “Inbound Logons” and “Outbound Logons” sections.
This menu item shows the local interactive, inbound interactive, and network logons onto the system. They are grouped together to show you when the system was being used, regardless of how the user got onto the system.
Cyber Triage merges together from multiple sources to provide these sessions. For example, it will parse events from the Security and Terminal Services log to identify events that correspond to the same time when a user logged in and show them to you as a single session. The various places that were used to determine a session can be found in the Sources tab.
You should review this data to look for sessions with suspicious locations or users. Remote logons are used to move laterally within corporate environments and to launch programs.
3.5.2.5.2.1. Inbound Logon Summary Panel
When you first open this section, you’ll see a summary panel that can help you focus on certain types of data.
Inbound Logons Summary Interface
The Overview section gives you an overview of what kind of logon data exists. It gives the number of sessions and date ranges that were found in various logs. This will give you some idea about how much historical data you’ll be seeing.
The Suspicious section will give you the unique descriptions of why logons were scored as suspicious.
The Recent Failed Logons section will show you which remote interactive logons were recently failed. This can be helpful to look for password attacks.
The Histogram section shows you which users logged in and from where for the last 12 months of the system (if there is enough data). For accounts that logged in within the past two months, it will also show what host was used. The term “Various” in the host column means that multiple hosts were merged into a single row.
- The bottom part of the UI will show an overview of possibly interesting data from the last 45 days of the system:
The New Interactive Users section shows users who logged in for the first time using a remote interactive session. This could be from an attacker who used compromised credentials to log into this system. Or, it could be a new employee or a change in job responsibility.
The New Interactive Hosts (Old Users) section shows which hosts that existing users started to use. For example, if user ‘jdoe’ has used a computer for 1-year, then they will only show up in this table if they start to come in from a new IP/host. This could be a sign that the user’s account is compromised and the attacker is coming in from atypical locations. Or, it could be that a user comes in from different IPs based on VPN or DHCP.
The Network Logons section shows all of the recent, unique network logons (i.e. that are not interactive). These happen when a remote user mounts a file share, uses a tool like PsExec, and various other methods. There are some routine IT network logons and this data should be reviewed to look for unexpected combinations.
3.5.2.5.2.2. Inbound Logon Search Panel
The second tab allows you to search for logon sessions. By default, all logon sessions are shown and grouped by unique combinations of local user and source host (“local” is used for local interactive logons).
Inbound Logons Interface
You can change the search criteria to focus on time ranges or types of logons. The following filters exist:
Show all suspicious items will show only logons that are scored as suspicious.
Group by will allow you to group the hundreds or thousands of sessions so that you can identify anomalous combinations of hosts and users. By default, the sessions are grouped by remote host and local user, but you can focus instead only on local users or on remote hosts.
Time will allow you to focus on sessions that occurred within the time range. This allows you to, for example, ignore sessions that happened a year ago.
Logon result will allow you to only focus in on failed logons or to ignore them if they are a lot of noise.
Type will allow you to focus on only local logons, remote interactive, or network logons. By default, all three are shown.
Order By allows you to specify how the groups are sorted. By default, it shows the most recent logons first, but you can also order by host, etc.
You can select a group and then see individual sessions. Selecting a session allows you to see details on the bottom about the user and hosts.
What Should You Do: Review this data to look for suspicious hosts, users, and times. Cyber Triage® may mark some of them as being suspicious and you should review those and others to identify them as Good or Bad.
3.5.2.5.2.3. Logon Info Panel Tabs
Once an incoming/outgoing logon is selected, you can view more information about that logon in the Logon Info Panel and the related tabs shown below.
This tab shows related logon sessions.
Logon Info Panel - Related Login Session Tab
The Sources section of the Item Inspector will show from which artifact we pulled any logon data associated with a particular logon session.
Item Inspector - Sources
Logon Info Panel - Related Login Session Tab
3.5.2.5.3. Outbound Logons
The same panels are present for Outbound Logons. The Outbound Logon menu item shows logons that local users made to other systems. This data often does not have all logons, but may have data from applications that save which hosts were used and from some event logs.
3.5.2.5.3.1. Outbound Logon Summary Panel
Like the Inbound Logon section, this area starts off with a summary panel to show recent destinations and users.
Inbound Logons Summary Interface
The following areas exist:
The Overview section gives you an overview of what kind of logon data exists. It gives the number of sessions and date ranges that were found in various logs. This will give you some idea about how much historical data you’ll be seeing.
The Suspicious section will give you the unique descriptions of why logons were scored as suspicious.
The Histogram section shows you which users logged into other systems and where they went for the last 12 months of the system (if there is enough data). For accounts with activity within the past two months, it will also show what host was used. The term “Various” in the host column means that multiple hosts were merged into a single row.
- The bottom part of the UI will show an overview of possibly interesting data from the last 45 days of the system:
The New Interactive Users section shows users started to have outbound logons. This could be from an attacker gained access to this system and started to laterally move around. Or, it could be a new employee or a change in job responsibility.
The New Interactive Hosts (Old Users) section shows which hosts that existing users started to use. For example, if user ‘jdoe’ has used the computer for 1-year, then they will only show up in this table if they start to log onto new hosts. This could be from an attacker or change in job responsibility.
3.5.2.5.3.2. Outbound Logon Search Panel
The search interface allows you to view all outbound logons organized by local user and remote host.
Outbound Logons Interface
You can change the search criteria to focus on time ranges or types of logons. The following filters exist:
Show all suspicious items will show only logons that are scored as suspicious.
Group by will allow you to group the sessions so that you can identify anomalous combinations of hosts and users. By default, the sessions are grouped by remote host and local user, but you can focus instead only on local users or on remote hosts.
Time will allow you to focus on sessions that occurred within the time range. This allows you to, for example, ignore sessions that happened a year ago.
Order By allows you to specify how the groups are sorted. By default, it shows the most recent logons first, but you can also order by host, etc.
You can select a group and then see individual sessions. Selecting a session allows you to see details on the bottom about the user and hosts.
What Should You Do: Review this data to look for suspicious hosts, users, and times. Cyber Triage® may mark some of them as being suspicious and you should review those and others to identify them as Good or Bad.
3.5.2.5.4. Network Shares
This Network Shares menu item shows the remote network shares that were accessed. These are determined by explicit mounts and paths in processes, data accessed, etc.
Network Shares Interface
The rows in this table are grouped by remote host and rows include share name, users, and times.
What Should You Do: You should review this data to look for shares that the user should not have needed access to. This could indicate that the account was compromised or the user is looking for sensitive data.
3.5.2.5.5. Web Artifacts
The Web Artifacts menu item shows web history, bookmarks, downloads, and cookies from Chrome, Firefox, Edge, and IE browsers. You can use this information to see what the user was viewing or what they downloaded. This is useful for phishing campaigns that cause the user to download executables or when you suspect an insider.
Web Artifacts Interface
What Should You Do: Review these items to look for suspicious downloads or search queries. You can filter based on type and date range.
3.5.2.5.6. Data Accessed
The Data Accessed menu item shows files or folders that a user accessed. This could have been because they opened or saved a file on the machine. Example contents of this section include Most Recently Used (MRU) lists.
You can use this information to see what data the user accessed during their session. Attackers may open files while looking for sensitive information. It can also show if Phishing documents were opened.
Data Accessed Interface
What Should You Do: Review these items to look for suspicious data the user may have accessed, which you can filter by date range.
3.5.2.6. Process Information Artifact Types
3.5.2.6.1. Triggered Tasks
The Triggered Tasks menu item shows any program that will launch based on some trigger, such as the computer starting, a user logging in, or some other event. Examples include AutoRuns, Scheduled Tasks, WMI Actions, BITS Jobs, services, and cron jobs.
Triggered Tasks Interface
What Should You Do: Review the scheduled tasks and actions to identify ones that could be malicious programs that periodically run to check the system status or query a remote server. Look for suspicious paths, times, or names. You may find it useful to add the scheduled tasks that are known and common in your environment to a Global Good List.
3.5.2.6.2. Processes
The Processes menu item shows the programs that were running at the time of collection or that ran in the past. The historical data comes from registry data and other system files (such as Prefetch).
You should review this data to look for suspicious processes. Cyber Triage will flag ones that ran out of unexpected places or had unexpected parents.
There are two UI panels that you can change via the tabs on the top:
Processes: Is a search-like interface that allows you to search for processes with certain features (such as times, signatures, etc.)
Process Tree: Shows the tree hierarchy of the processes at the time of collection.
3.5.2.6.2.1. Process Search Panel
When you first open the Processes section, you’ll see the search panel, which shows the list of processes that meet the specified criteria. By default, the processes are grouped by executable and arguments, but the grouping can be changed to simply focus on executable or to also include the user.
Processes Search Interface
By default, the groups are sorted by those that ran most recently.
There are several search parameters that you can specify:
Show Bad and Suspicious Items: Show only the processes that have been scored as bad or suspicious. You can use this to understand what was already scored by Cyber Triage.
- Group by: Allows you to change how all of the processes are grouped.
Exe & Arguments: The default, that shows the executable name and arguments. Arguments can dramatically change the behavior of a process, so it can be important to group by this to identify good versus bad usage.
Exe: Use this to see what programs were run, regardless of what arguments were supplied.
Exe, Arguments, & User: Use this to also differentiate who ran a process.
No Grouping: Use this to get a long list of all processes. This creates a process timeline.
- Run date: Show only processes that were running within that time frame, relative to time of collection. Note that some places that store historical process information do not have times and they will not be included in the search.
Last 1 day: Processes that were running in the 24-hours before collection (including a live collection snapshot). You can use this to look for unexpected processes. Note that other filters hide standard Windows processes, so this list is shorter than all processes.
Last 30, 60, etc: Same idea as “Last 1 day”, just for longer periods of time.
- Hide items: Allows you to not see certain types of processes IF you are looking for outliers and unexpected processes. Note that some of these filters may make it harder to detect Living Off the Land (LOL) usage.
Scored as Good: Hide processes that got a Good score from either a good list, malware analysis, or manual score. This is enabled by default.
Files signed by trusted certificate: Hide processes with an executable that is signed by a certificate that was trusted by the host. This is enabled by default.
In standard location: Hide processes running out of Windows or Program Files. This is disabled by default.
Order by: How to order the groups. The default is to order by most recent execution first. But, you can also sort by path or by frequency of usage.
When you select a group, you can go into it to see the individual process instances.
Once you’ve selected an instance, you maybe able to see its parent and children processes if it was running at the time of collection and you used the Cyber Triage collection tool. The “Process” tab in the lower right has a “Tree” tab that will show the parent and children. It will be disabled if this instance was known only from historical data.
If you have false positives from applications running out of non-standard locations (such as AppData), you can add them to the good list.
3.5.2.6.2.2. Process Tree Panel
An alternative view is to see the process tree. This works only if you did a live collection using the Cyber Triage collection tool. This view shows you the root processes and allows you to select a process and see its children. You can then recursively traverse the tree by pressing the “X children” text (if it has children).
Processes Tree Interface
Processes Tree Interface
You can also use the “Export as PNG” button in the upper right to export the picture.
3.5.2.6.3. Active Connections
This Active Connections menu item shows the network connections that were open at the time the collection was made.
Active Connections Interface
The rows are grouped by remote host and have columns for the process with the connection, remote and local ports, times, and direction.
What Should You Do: You should review this data for connections to unexpected hosts and for processes with unexpected network
3.5.2.6.4. Listening Ports
The Listening Ports menu item shows the ports that were listening for new connections when the collection was made.
Listening Ports Interface
The rows are grouped by port number and have columns for the protocol, process, user, and information about what is usually at that port number.
What Should You Do: Review these to processes that you did not expect to be listening for a connection. These could be backdoor applications into your system. Consider adding ports that are normal in your environment to a Good List.
3.5.2.6.5. DNS Cache
The DNS Cache menu items shows the contents of the DNS cache, which contains references to the hosts that the computer tried to resolve to an IP address. You will find addresses in here that the system previously connected to.
DNS Cache Interface
The rows are grouped by remote host domain and have columns for IP and country.
What Should You Do: You should review the data here for suspicious items and connections to suspicious hosts or countries.
3.5.2.7. System Confirmation Information Artifact Types
The System Configuration section focuses on artifacts associated with the operating system.
3.5.2.7.1. OS Config Settings
This area shows you various OS and application settings that were enumerated during the collection. These come from various registry keys and other configuration files.
Settings Interface
What Should You Do: Review the data to detect if any security settings were disabled or determine what the audit settings were.
3.5.2.7.2. Attached Devices
This area shows you what removable devices were attached to the host. This will most typically show USB devices. You can use the “Sources” tab to identify which data artifact it was derived from.
Cyber Triage will map some common vendor and product IDs to display names instead of numbers.
3.5.2.8. Additional Examination Views
Cyber Triage has other views that merge multiple types of artifacts, such as timelines and search.
3.5.2.8.1. File Explorer
The Files menu item can show several things:
If a full file system scan was performed, you can view all file metadata. Though, content for all files will not be available.
You can view only suspicious or bad files.
You can get to a file by choosing the Files menu item and navigating the structure, or when you are reviewing an item associated with a file, such as a Triggered Task item, using one of:
The View Folder button in the item detail panel’s Overview section.
View Folder button in the item detail panel
The “…” menu’s View in File Explorer option.
View in File Explorer from the “…” menu
That will then bring you directly to the file:
File Interface
What Should You Do: Review the suspicious entries. The files flagged as malware will also be in the Bad Items menu item. You can also use this to see what other files are located in the same folder as malware and other Bad Items.
3.5.2.8.2. Host Timeline
This area shows you the collected items organized by time. You can use this data to identify what happened before and after a specific event.
Timeline Interface
Sequential items that share the same path or URL are grouped together into a single collapsible row (e.g. “5 items”) - click it to expand and see the individual events.
Grouped sequential items in the timeline
Expanded group
With an item from an expanded group selected, press Regroup to collapse it back.
Regroup button
You can get to this data by selecting Timeline from the left side and picking a date range, or from an individual item via either:
The “…” menu’s View in Timeline option.
The clock icon next to a date/time field in the item detail panel’s Overview section.
Choose View Timeline
At any point, if the timeline becomes overwhelming, you can reduce the amount of data shown by using the filters:
The Notable Items filter allows you to pick what types of scored items to include:
“Always display bad and suspicious” means that regardless of the other filters, each bad and suspicious will always be shown to make sure you have the full context of what is known.
“Display only bad and suspicious” means that you will only see items with a score. This is basically equivalent to the “Review Notable Items” view.
“Ignore item scores” means that scores will not be considered. Only the other filters will be used.
The Event Types Filter allows you to pick what artifact types to display. You can also choose which file times to include or hide.
3.5.2.8.3. File and Artifact Host Search
You can search all artifacts and file metadata in the host for specific keywords. This is not a full text search of file content. It will search data such as paths, arguments, host names, hash values, and scores.
To search: 1. Choose Host Search from the lower left of application 2. Enter in the search term. The search will be case insensitive and regular expressions are not supported. You can also specify a date range.
Note that there is also a search bar at the top of other data type-specific UI panels. That will search only the data that is visible in the current table or page. It is not across all types or even pages that are not displayed.
3.5.2.8.4. Artifact Sources
The Artifact Sources view allows you to see what “Information Artifacts” Cyber Triage created based on “Data Artifacts”. You’d use this view if, for example, you wanted to validate the Cyber Triage results and see all Processes that were created from Prefetch artifacts.
When you select this option, you will see all of the data artifacts that were used to create information artifacts. Selecting the “Prefech” node will show you all processes that were created from it.
3.5.2.8.5. Country Resolution
IP addresses and host names will be resolved to a country using GeoLite2 data created by MaxMind. There should either be a column in each relevant table with this data or it is available in the Hosts tab at the bottom of the screen.