/*! \page ct_malware_scanner_page Cyber Triage Malware Scanner Module

[TOC]

What Does It Do
========

The Cyber Triage Malware Scanner module will use the malware scanning infrastructure from Cyber Triage to identify if any Windows executables are malware. It will query an online service using the file's hash value to see if the file was already analyzed and allows you to upload files for analysis if they are new.

This module requires a commercial license from Cyber Triage.

For more information on what the module does or obtaining a license, refer to [CyberTriage.com](https://cybertriage.com/autopsy-malware-module). The remainder of this page is about the use of the module once it is licensed. 


Configuration
==============

You will need to first get a paid or eval license from the above URL.  The code will come in via email. Example license formats include:

* AUT-8ed86eb5-17fc-4b3a-9b75-ce638c11b070
* b826a555-951f-42ca-86ce-439a81106688

Once you have a license, you must add it on the Autopsy Options panel.
Choose the 'Cyber Triage' tab and choose 'Add License'.

\image html malware-scanner-global-options-panel-no-license.png

After you enter the license number from your email, you will then need to review and agree to the license terms. 


The options panel should now display information about the lookup limits. You can always refer back to here about what your limits are and when they reset. 

\image html malware-scanner-global-options-panel.png



Using the Module
======

Ingest Settings
------

For each data source, you select if you want files to be uploaded if they have not already been analyzed. By default, they are uploaded. You can choose to not upload them though. Refer to the main [website](https://cybertriage.com/autopsy-malware-module) for details on what happens when files are uploaded. 

\image html malware-scanner-ingest-panel.png



Out of Scans
-------

If you go beyond your limits, you will get a dialog that not all files were analyzed.  You can wait until your limits reset and then start ingest again with only the malware scanning module enabled. It will ignore the files that are already analyzed.


Seeing Results
------

Once ingest has completed, the files with malware will be listed in the Malware node in the tree. 


\image html malware-artifact-tree.png

*/