withsecurelabs / linuxcatscale Goto Github PK
View Code? Open in Web Editor NEWIncident Response collection and processing scripts with automated reporting scripts
License: GNU General Public License v3.0
Incident Response collection and processing scripts with automated reporting scripts
License: GNU General Public License v3.0
In the edge case where you don't want to full filesystem timeline because of i/o restrictions, one would still need a peek into the content of /tmp
.
As it's an edge case, there's no need to add it to the logstash configuration.
In a recent case, I used the script on Suse Linux Enterprise, and the lsof excluding gvfs caused an error. If I remember correctly, it didn't like the fact that excluded path didn't exist.
I worked it around by removing the -e
parameter. I wonder whether it should be kept, in which case an additional if clause could be added for better compatibility; or if it could just get stripped.
Hello,
On Linux, your script only collects the main routing table:
Lines 293 to 294 in 76302aa
I would suggest to call ip rule
and ip --details route show table all
instead of only ip route
to get more information.
Working on a case today and the script hang.. after a bit of investigation and we figured out it was the get_executables function which states:
find / -type f -perm -o+rx -print0 | xargs -0 sha1sum
The reason behind the hang was that the system had a network share (fuse.sshfs) that was mounted, yet the outgoing/incoming traffic due to the incident was moderated heavily.. so basically the mountpoint was broken.
To avoid that with any other situation similar we could do a quick fix of:
find / ! -fstype nfs,sshfs,fuse.sshfs -type f -perm -o+rx -print0 | xargs -0 sha1sum
Or I we could explore a more inclusive solution that makes sure the mount points are alive before running the find (or running it with parameters defining specific paths) if we really want ALL the bins from ALL the things
Upcoming PR to add the zypper package list in addition of yum/apt listing. I'll edit this issue once I get the commit on my forked repo.
On a known Ubuntu system with Docker running I was receiving no collection for the Docker containers. I noticed under the execution section for Ubuntu, at Line 778 in Cat-Scale.sh, the following 2 lines were missing:
echo " - Docker and Virtual Machine info..."
get_docker_info
Addition of those lines resulted in a collection.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.