Skip to main content

Introduction

Revision History​

DateAuthorSummary
07-JUN-2022TSgt. BernadotteInitial draft
06-NOV-2022TSgt. BernadotteReformatted

Purpose​

This SOP standardizes Metasponse collectors and settings to be set as pre-configure job templates.

End-State​

The following Metasponse job templates will be created for operators to be able to clone to save time and have consistent deployment configurations:

  • DISCOVERY-TEMPLATE
  • VOLATILE_INFO-TEMPLATE
  • PERSISTENCE-TEMPLATE
  • DIRWALK-TEMPLATE
  • SYSTEM_CONFIG-TEMPLATE
  • TRIAGE-TEMPLATE
  • PROCESS_####-TEMPLATE
  • FORENSIC-TEMPLATE
  • MEMORY_DUMP-TEMPLATE
  • AUDIT_POWERSHELL-TEMPLATE

Considerations​

This SOP directs the operator to save authentication credentials to each job template to save time during execution and reduce the risk of lockouts due to mis-typed passwords – if more than one set of authentication credentials will be used in the environment, then duplicates of each template will need to be made in order to accommodate each credential set