forensic-triage

Forensic triage on a compromised system is automated by collecting and analyzing disk, memory, and log evidence to build a chronological incident timeline. This Skill requires appropriate external tools for evidence collection and analysis to determine the extent of the incident.

Building an incident timeline from memory and disk evidence involves gathering artifacts with proper handling and creating a chronological record of attacker actions. The process tags observed techniques using ATT&CK mapping for follow-up detection and scope estimation.

Yes, you can map attacker techniques to the ATT&CK framework during the forensic triage process. The Skill tags observed techniques from the collected disk, memory, and log evidence to enhance detection and guide follow-up incident response actions.

Yes, you need appropriate external tools to perform evidence collection and analysis. The Skill automates the triage workflow and builds the incident timeline, but it requires separate tools to gather and process the disk, memory, and log evidence from the compromised host.

You need forensic triage for incident response when investigating a compromised system or scoping an incident. It is used to determine the extent of the attack, identify affected systems, and preserve evidence integrity by collecting disk, memory, and log data.