34. Forensics and IOC hunts

Forensics is where an incident is investigated. A case (investigation) gathers evidence from one or more hosts: live-response collections, collected files, triage packages, memory captures and uploads. Every item is hashed on the host and verified on arrival, with a chain of custody. A super-timeline merges every event. From the case you can hunt for indicators and take response actions on the case's hosts.

An IOC hunt sweeps hosts for known indicators (file hashes, names and paths, network indicators, processes, registry keys, YARA rules) and reports what each host found. A hunt can run on its own or from inside a case.

Forensics is a licensed module.

Permissions:

34.1 The Forensics page#

Path: Forensics. The page title is Digital forensics.

• Tiles: Investigations, Open, Artifacts, Findings.
• IOC hunts (button) opens the hunts page (34.6).
• Investigation queue: Name, Status, Findings, Opened; Search investigations.... Click a case to open it.

Procedure: open a case#

1. Press New investigation.
2. Fill Open an investigation: Case name (for example "Suspected persistence on app-01"), What prompted it (for example "FIM event on /etc/systemd/system"), Priority (low, medium, high, critical).
3. Press Open case.

Cases are also opened from Logs > Alerts (Escalate), from Stories (Open an investigation) and by playbooks.

A case cannot be renamed, closed or deleted from the console in this release. It stays in the Investigation queue with its evidence and chain of custody, which is what an auditor or a court expects. Record the outcome as a finding in the review queue or in an evidence bundle (chapter 27, scope Investigation).

34.2 The case workspace#

The case page shows the case name, priority and status, the Case hosts strip ("No hosts yet - running a collection on an agent adds it.") and seven tabs:

Any enrolled agent can be chosen in the host lists; the case's hosts are listed first.

34.3 Collecting evidence#

Collections only read from the host. Risk: a memory capture or a large file collection uses disk, CPU and network on the host for its duration. Rollback: not needed.

Procedure: run live response#

1. Open the case, tab Live response. "Each result is hashed on the host and verified on arrival."
2. Choose the Host and the Recent-file window (days).
3. Tick the collectors you want.
4. Press Run collectors.

What you see: a row per collector in Runs: Collector, Status, Records, Integrity, Timeline. Open shows the records. "hash mismatch" in Integrity means the stored copy does not match what the agent sealed on the host: do not rely on it; collect again.

Procedure: collect files, a triage package or memory#

1. Open the case, tab Triage & files. "Uploaded in resumable chunks, re-hashed on arrival."
2. Choose the Host. Enter Files and globs, one per line (** recurses), Largest file (MB) and Total budget (MB).
3. Press one of:
   • Collect files - pull the listed files byte for byte.
   • Build triage package - every collector the host supports plus the listed files, in one zip with a manifest of hashes.
   • Capture memory - "Linux: avml on the host. Windows: winpmem where configured. macOS cannot; the run says why."
4. Follow progress in Collection runs.

Procedure: attach a file from your computer#

Use this for a file you already have, for example a sample a user sent.

1. Open the case, tab Triage & files.
2. Under Attach a file from this computer, press Choose file and pick the file. The button shows Uploading... while it is sent in resumable chunks.
3. What you see: the file in the Artifacts tab, hashed on arrival.

34.4 Artifacts and chain of custody#

Tab Artifacts: Name, Type, Host, Size, State, Custody, Collected; filter by Name, host, path or hash... and type.

Click an item: Host, Collector, Collected, Status, Path on host, sha256, an integrity mark (the sha256 taken on the host equals the stored copy's, or not), the Chain of custody (every access, by whom, when) and, for structured data, its Records with a filter.

Procedure: download an artifact#

Permission: Run forensics. The download is itself recorded in the chain of custody.

1. Open the case, tab Artifacts, and click the item.
2. Check the integrity mark next to the sha256 (the hash taken on the host equals the stored copy's).
3. Press Download. The file is saved to your computer. If it fails: "Download failed."

Treat downloaded evidence as dangerous: open malware samples only in an isolated analysis environment. Artifacts are not deleted from a case in the console.

34.5 The super-timeline#

Tab Timeline (Super-timeline): every event from every collection, in time order.

Procedure: filter and export the timeline#

1. Open the case, tab Timeline.
2. Fill the filters you need: Host, Event type (for example login), Text, From and To. Press Apply. Source buttons switch whole sources on and off.
3. Page through with Load the next N.
4. To export what the filters select, press CSV or JSON (needs Run forensics). The file downloads; if it fails: "Export failed."

34.6 IOC hunts#

Path: Forensics > IOC hunts (or the Hunt tab of a case). "Sweep hosts for file hashes, names and paths, network indicators, processes, registry keys and YARA."

Procedure: start a hunt#

Permission: Run forensics. Four-eyes: no. Risk: each target host reads files and process lists within the limits you set. Rollback: Cancel stops hosts that have not reported.

1. Press New hunt.
2. Fill Hunt name and Description (optional).
3. Indicators: paste them, or Load file. Choose the Parse format (auto, list, CSV, STIX 2.1). Indicators the agents cannot hunt are listed as "Not hunted (unsupported)".
4. YARA rules (optional): paste rules and press Validate; "Rejected" shows errors. "The server validates again on submit."
5. Targets: tick hosts (Filter by hostname or platform, All online, Clear). "Offline agents in the selection are recorded as offline and not sent the hunt."
6. Optional limits: File roots, one per line (blank = agent defaults), Max files per host, Max file size (MB), Max bytes read (MB), Time budget (s).
7. Press Start hunt.

What you see: the hunt in the list (Hunt, Progress, Started). Open it for Hosts (Host, Status, Files, Error), Hits (Indicator, Where, Evidence; Filter hits), the scan statistics per host (Files seen, Files read, Bytes read, Processes, Connections, Elapsed, YARA engine), Sources and Skipped. "A limit was reached; the scan is incomplete" means a limit stopped it early on that host; raise the limit and hunt again if needed.

A hunt hit can trigger a playbook (chapter 37) and appears in the review queue.

Procedure: stop a hunt or export its results#

1. Open Forensics > IOC hunts and click the hunt.
2. To stop it, press Cancel hunt and confirm "Cancel this hunt? Hosts that have not reported yet are marked cancelled." Hosts that already reported keep their results.
3. To export the results, press CSV or JSON in the hunt view. The file downloads. Refresh reloads the view.

Hunts are kept as a record; there is no delete. A hunt cannot be edited after it starts: start a new hunt with the changed indicators or targets.

34.7 Response from a case#

Tab Response: "Respond on a case host - Signed, audited, and undoable where the action allows."

Permission: Execute containment. Four-eyes: yes.

Risk and rollback are those of the action; see the table in chapter 36.

1. Choose the Host and the Action (Isolate host, Kill process, Block address, Quarantine file, Disable account, Force password reset...). Fill the parameters it needs (Process name, IP address, File path, Account). The panel says whether it "Can be undone from the history below." or "Cannot be undone."
2. Press Run and confirm.
3. Complete the four-eyes request (20.4).

What you see after execution: "<action> queued. The host runs it on its next check-in; the outcome appears below and on the case timeline." Actions in this case lists When, Target, Status, with an undo button where the action is reversible.

34.8 If it fails#