what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

GRR 3.4.2.0

Posted Jul 7, 2020

Authored by Andreas Moser, Mikhail Bushkov, Ben Galehouse, Milosz Lakomy | Site github.com

GRR Rapid Response is an incident response framework focused on remote live forensics. The goal of GRR is to support forensics and investigations in a fast, scalable manner to allow analysts to quickly triage attacks and perform analysis remotely. GRR consists of 2 parts: client and server. GRR client is deployed on systems that one might want to investigate. On every such system, once deployed, GRR client periodically polls GRR frontend servers for work. "Work" means running a specific action: downloading file, listing a directory, etc. GRR server infrastructure consists of several components (frontends, workers, UI servers) and provides web-based graphical user interface and an API endpoint that allows analysts to schedule actions on clients and view and process collected data.

Changes: New SplunkOutputPlugin to export Flow/Hunt results to Splunk. New NTFS virtual file system handler for file system parsing using libfsntfs. A couple new flows and multiple other updates.

tags | tool, remote, web, forensics

systems | unix

SHA-256 | 3232771035cbd0580621c3e72dee06ff39416a505e07281e82a2d72191e1bb05

Download | Favorite | View

Related Files

No related files