This job template is designed to collect volatile information for initially supplementing an emerging incident investigation. Triage data will answer "what" happened, while forensic data will follow-up and usually answer "how" or "why" it happened.
| Job Metadata |
| Name | TRIAGE-TEMPLATE |
| Plugin Selection |
| 📷 Collectors | Custom Plugins:- 262 - [💾Persistence] BITS Jobs (Win)
- 262 - [💾Persistence] COM Objects (Win)
- 262 - [💾Persistence] Filesystem Persistence (Win/Linux)
- 262 - [💾Persistence] Registry Persistence (Win)
- 262 - [💾Persistence] Scheduled Tasks/CRON Jobs (Win/Linux)
- 262 - [💾Persistence] Services (Win/Linux)
- 262 - [💾Persistence] Startup Commands (Win)
- 262 - [💾Persistence] User Accounts (Win/Linux)
- 262 - [💾Persistence] WMI Subscriptions (Win)
- 262 - [🔥Volatile Info] ARP Cache (Win/Linux)
- 262 - [🔥Volatile Info] DNS Cache (Win)
- 262 - [🔥Volatile Info] Injected Threads (Win)
- 262 - [🔥Volatile Info] Logged-on Users (Win/Linux)
- 262 - [🔥Volatile Info] Netstat (Win/Linux)
- 262 - [🔥Volatile Info] Processes (Win/Linux)
|
Built-in Plugins:- Autoruns Collector
- DNSCache Collector
- HashProcess Collector
- Mutex Collector
- Netstat Collector
- RAIR Collector
- Active Sessions Collector
- Survey Collector
|
| ⛙ Transports | WMI Transport (if Windows targets + credentials available)SMB Transport (if Windows targets + credentials available)SSH Transport (if *Nix targets + credentials available)
|
| 🔍 Analyzers | |
| Configuration Options |
| ⛭ Pickup | Maximum Pickup File Size
job.pickup.maxsize | 1 Gigabyte |
Maximum Timeout
job.pickup.timeout | 10 Minutes |