3.3.3.2. Add Over The Network - Manual Launch

Network - Manual (previously called ‘Live Manual’) is for cases when you cannot automatically push the Collector to the remote system. In this approach, you run the Collector from the remote system and it sends the results over the network to Cyber Triage®.

The Collector will need to be able to communicate with the Cyber Triage® system over TCP port 443.

If you haven’t already done so, extract the Collector to a USB drive using the steps outlined in Extracting the Collector.

To perform the collection, you will need to interact with both Cyber Triage® and the remote system.

Watch the Cyber Triage Basics Course Manual video on this technique.

3.3.3.2.1. Prepare Cyber Triage For the Data

In Cyber Triage®:

  1. Choose the Network - Manual box from the Add New Host area, and enter a display name for the host being collected from (it can be a host name or more descriptive).

../../_images/import_add_network_manual.jpg

Network - Manual

  1. If this is the first time that you are running Cyber Triage®, you maybe prompted by Windows Firewall or another security application to allow Cyber Triage® to accept connections. You will need to do this to allow data to be imported into Cyber Triage®.

  2. Cyber Triage® will tell you what settings to use on the remote system, including a ready-to-run command line (with a Copy Command button) and a link to extract the Collector.

../../_images/import_network_manual_settings.jpg

Network - Manual Settings

  1. You will then be prompted to configure malware scanning settings, see Ingest-Time Settings.

At this point, Cyber Triage is waiting for an incoming connection from the Collector.

3.3.3.2.2. Start Collection on Remote Host

Next, perform the following on the remote system.

  1. Insert the USB device with the Collector, or ensure that the Collector is available via a network share.

  2. Launch the Collector either:
    • From the command line and specify ‘–server’ and other arguments
      CyberTriageCollector.exe --server host1 --cert_hash e21be6eb --sessionid 1234567890

    • From the GUI Wrapper and specify the server name as the target.

    ../../_images/import_collector_gui_manual.png

After collection has started, proceed to Host-level Examination for an overview of the analysis techniques.