DFIRTrack (Digital Forensics and Incident Response Monitoring utility) is an open supply net utility primarily primarily based on Django utilizing a PostgreSQL database backend.
In distinction to different nice incident response instruments, that are primarily case-based and help the work of CERTs, SOCs and so on. of their every day enterprise, DFIRTrack is targeted on dealing with one main incident with lots of affected programs as it’s typically noticed in APT circumstances.
It’s meant for use as a device for devoted incident response groups in giant circumstances. So, in fact, CERTs and SOCs might use DFIRTrack as nicely, however they could really feel it will likely be extra applicable in particular circumstances as a substitute of day-after-day work.
In distinction to case-based functions, DFIRTrack works in a system-based trend. It retains monitor of the standing of varied programs and the duties related to them, maintaining the analyst well-informed concerning the standing and variety of affected programs at any time throughout the investigation part as much as the remediation part of the incident response course of.
Options
One focus is the quick and dependable import and export of programs and related data. The aim for importing programs is to offer a quick and error-free process. Furthermore, the aim for exporting programs and their standing is to have a number of situations of documentation: as an illustration, detailed Markdown reviews for technical employees vs. spreadsheets for non-technical audiences with out redundancies and deviations within the information units.
The next capabilities are applied for now:
Importer
- Creator (quick creation of a number of associated situations by way of net interface) for programs and duties,
- CSV (easy and generic CSV primarily based import (both hostname and IP or hostname and tags mixed with an online kind), ought to match for the export capabilities of many instruments),
- Markdown for entries (one entry per system(report)).
Exporter
- Markdown for so-called system reviews (to be used in a MkDocs construction),
- Spreadsheet (CSV and XLS),
- LaTeX (deliberate).
Set up and dependencies
DFIRTrack is developed for deploying on Debian Stretch or Ubuntu 16.04. Different Debian primarily based distributions or variations may go however weren’t examined but. For the time being the mission will probably be targeted on Ubuntu LTS and Debian releases.
For quick and uncomplicated set up on a devoted server together with all dependencies an Ansible playbook and function was written (obtainable here). For testing a docker setting was ready (see beneath).
For a minimal setup the next dependencies are wanted:
- django (2.0),
- django_q,
- djangorestframework,
- gunicorn,
- postgresql,
- psycopg2-binary,
- python3-pip,
- PyYAML,
- requests,
- virtualenv,
- xlwt.
Be aware that there isn’t a settings.py on this repository. This file is submitted by way of Ansible or needs to be copied and configured by hand. That will probably be modified sooner or later (see points for extra data).
Docker Setting
An experimental Docker Compose setting for local-only utilization is supplied on this mission. Run the next command within the mission root listing to start out the setting:
docker-compose up
A person admin is already created. A password may be set with:
docker/setup_admin.sh
The appliance is positioned at localhost:8000.
Constructed-in software program
The appliance was created by implementing the next libraries and code:
- Bootstrap
- clipboard.js
- DataTables
- jQuery
- Open Iconic
- Popper.js
Growth
There are two fundamental branches:
The grasp department must be secure (as you possibly can anticipate from an alpha model). New options and adjustments are added to the event department and merged into grasp now and again. All the pieces merged into improvement ought to run too however would possibly want guide adjustments (e. g. config).
Devolopment department of DFIRTrack Ansible ought to observe these adjustments. So if you wish to see the newest options and progress: “take a look at” improvement.
