README, deploy script
This commit is contained in:
overcuriousity
parent
5d05c62a55
commit
5795f3269f
670
README.md
670
README.md
@ -1,232 +1,149 @@
|
||||
# ForensicPathways
|
||||
|
||||
Ein kuratiertes Verzeichnis für Digital Forensics und Incident Response (DFIR) Tools, Methoden und Konzepte mit KI-gestützten Workflow-Empfehlungen.
|
||||
Ein umfassendes Verzeichnis digitaler Forensik- und Incident-Response-Tools mit KI-gestützten Empfehlungen basierend auf der NIST SP 800-86 Methodik.
|
||||
|
||||
## ✨ Funktionen
|
||||
## Lizenz
|
||||
|
||||
### 🎯 Hauptansichten
|
||||
- **Kachelansicht (Grid View):** Übersichtliche Kartenansicht aller Tools/Methoden
|
||||
- **Matrix-Ansicht:** Interaktive Matrix nach forensischen Domänen und Untersuchungsphasen (NIST Framework)
|
||||
- **Forensic-AI:** AI-gestützte Workflow-Empfehlungen basierend auf Szenario-Beschreibungen
|
||||
Dieses Projekt ist unter der BSD-3-Clause-Lizenz lizenziert.
|
||||
|
||||
### 🔍 Navigation & Filterung
|
||||
- **Tag-System:** Intelligente Filterung nach Kategorien und Eigenschaften
|
||||
- **Volltext-Suche:** Durchsuchen von Namen, Beschreibungen und Tags
|
||||
- **Domain/Phase-Filter:** Filterung nach forensischen Bereichen und Ermittlungsphasen
|
||||
## Funktionen
|
||||
|
||||
### 📚 Inhaltstypen
|
||||
- **Software/Tools:** Open Source und proprietäre forensische Software
|
||||
- **Methoden:** Bewährte forensische Verfahren und Prozesse
|
||||
- **Konzepte:** Grundlegendes Fachwissen und theoretische Grundlagen
|
||||
### Kernfunktionalität
|
||||
- **Umfassende Tool-Datenbank**: 100+ forensische Tools kategorisiert nach Domänen, Phasen und Skill-Levels
|
||||
- **NIST SP 800-86 Integration**: Vier-Phasen-Methodik (Sammlung → Auswertung → Analyse → Berichterstattung)
|
||||
- **Multiple Ansichtsmodi**: Kachelansicht, Matrix-Übersicht und KI-gestützte Empfehlungen
|
||||
- **Erweiterte Suche**: Textsuche, semantische Embedding-basierte Suche und Multi-Kriterien-Filterung
|
||||
- **Responsive Design**: Dark/Light-Mode-Unterstützung, mobile-optimierte Benutzeroberfläche
|
||||
|
||||
### 📖 Knowledgebase
|
||||
- **Erweiterte Dokumentation:** Detaillierte Artikel zu Tools und Methoden
|
||||
- **Praktische Anleitungen:** Installation, Konfiguration und Best Practices
|
||||
- **Markdown-basiert:** Einfache Erstellung und Wartung von Inhalten
|
||||
### KI-gestützte Analyse
|
||||
- **Micro-Task-Pipeline**: Intelligente Tool-Auswahl durch mehrere KI-Analyseschritte
|
||||
- **Semantische Suche**: Vector-Embeddings für natürlichsprachige Tool-Entdeckung
|
||||
- **Konfidenz-Bewertung**: Transparente Vertrauensmetriken für KI-Empfehlungen
|
||||
- **Audit-Trail**: Vollständige Entscheidungstransparenz mit detaillierter Protokollierung
|
||||
- **Rate Limiting**: Intelligente Warteschlangenverwaltung und nutzerbasierte Ratenbegrenzung
|
||||
|
||||
### 🤝 Contribution-System
|
||||
- **Tool/Methoden-Beiträge:** Webformular für neue Einträge
|
||||
- **Knowledgebase-Artikel:** Artikel-Editor mit Datei-Upload
|
||||
- **Git-Integration:** Automatische Issue-Erstellung für Review-Prozess
|
||||
- **File-Management:** Nextcloud-Integration für Medien-Uploads
|
||||
### Zusammenarbeit & Beiträge
|
||||
- **Tool-Beiträge**: Neue Tools einreichen oder bestehende über Git-Integration bearbeiten
|
||||
- **Knowledgebase**: Community-beigetragene Artikel und Dokumentation
|
||||
- **File-Upload-System**: Nextcloud-Integration für Medien-Anhänge
|
||||
- **Authentifizierung**: OIDC-Integration mit konfigurierbaren Anbietern
|
||||
|
||||
### 🔐 Authentifizierung
|
||||
- **OIDC-Integration:** Single Sign-On mit OpenID Connect
|
||||
- **Berechtigungssteuerung:** Schutz für AI-Features und Contribution-System
|
||||
- **Session-Management:** Sichere JWT-basierte Sessions
|
||||
### Enterprise-Funktionen
|
||||
- **Warteschlangenverwaltung**: Ratenbegrenzte KI-Verarbeitung mit Echtzeit-Status-Updates
|
||||
- **Audit-Protokollierung**: Umfassender forensischer Audit-Trail für KI-Entscheidungsfindung
|
||||
- **Multi-Provider-Unterstützung**: Konfigurierbare KI-Services (Mistral AI, Ollama, OpenAI)
|
||||
- **Git-Integration**: Automatisierte Issue-Erstellung für Beiträge (Gitea, GitHub, GitLab)
|
||||
|
||||
## 🛠 Technische Grundlage
|
||||
## Datenmodell
|
||||
|
||||
- **Framework:** Astro 4.x mit TypeScript
|
||||
- **Styling:** CSS Custom Properties mit Dark/Light Mode
|
||||
- **API:** Node.js Backend mit Astro API Routes
|
||||
- **Datenbank:** YAML-basierte Konfiguration (tools.yaml)
|
||||
Das System verwendet eine YAML-basierte Konfiguration in `src/data/tools.yaml`:
|
||||
|
||||
## 📋 Voraussetzungen
|
||||
```yaml
|
||||
tools:
|
||||
- name: Tool Name
|
||||
type: software|method|concept
|
||||
description: Detaillierte Beschreibung
|
||||
skillLevel: novice|beginner|intermediate|advanced|expert
|
||||
url: https://tool-homepage.com
|
||||
domains: [incident-response, static-investigations, ...]
|
||||
phases: [data-collection, examination, analysis, reporting]
|
||||
platforms: [Windows, Linux, macOS]
|
||||
license: Lizenztyp
|
||||
tags: [gui, commandline, ...]
|
||||
related_concepts: [konzept1, konzept2]
|
||||
# Optionale Felder
|
||||
projectUrl: https://hosted-instance.com # Für CC24-Server gehostete Tools
|
||||
knowledgebase: true # Hat KB-Artikel
|
||||
accessType: download|hosted|cloud
|
||||
|
||||
- **Node.js:** Version 18.x oder höher
|
||||
- **npm:** Version 8.x oder höher
|
||||
- **Nginx:** Für Reverse Proxy (Produktion)
|
||||
domains:
|
||||
- id: incident-response
|
||||
name: Incident Response & Breach-Untersuchung
|
||||
|
||||
phases:
|
||||
- id: data-collection
|
||||
name: Datensammlung
|
||||
description: Imaging, Akquisition, Remote-Collection-Tools
|
||||
|
||||
## 🔧 Externe Abhängigkeiten (Optional)
|
||||
|
||||
### OIDC Provider
|
||||
- **Zweck:** Benutzerauthentifizierung
|
||||
- **Beispiel:** Nextcloud, Keycloak, Auth0
|
||||
- **Konfiguration:** `OIDC_ENDPOINT`, `OIDC_CLIENT_ID`, `OIDC_CLIENT_SECRET`
|
||||
|
||||
### Nextcloud
|
||||
- **Zweck:** File-Upload für Knowledgebase-Beiträge
|
||||
- **Features:** Medien-Management, öffentliche Links
|
||||
- **Konfiguration:** `NEXTCLOUD_ENDPOINT`, `NEXTCLOUD_USERNAME`, `NEXTCLOUD_PASSWORD`
|
||||
|
||||
### AI Service (Mistral/OpenAI-kompatibel)
|
||||
- **Zweck:** KI-gestützte Tool-Empfehlungen
|
||||
- **Konfiguration:** `AI_ANALYZER_ENDPOINT`, `AI_ANALYZER_API_KEY`, `AI_ANALYZER_MODEL`
|
||||
|
||||
### Uptime Kuma
|
||||
- **Zweck:** Status-Monitoring für gehostete Services
|
||||
- **Integration:** Status-Badges in der Service-Übersicht
|
||||
|
||||
### Git Provider (Gitea/GitHub/GitLab)
|
||||
- **Zweck:** Issue-Erstellung für Contributions
|
||||
- **Konfiguration:** `GIT_PROVIDER`, `GIT_API_ENDPOINT`, `GIT_API_TOKEN`
|
||||
|
||||
## 🚀 Installation
|
||||
|
||||
### Lokale Entwicklung
|
||||
|
||||
```bash
|
||||
# Repository klonen
|
||||
git clone https://git.cc24.dev/mstoeck3/forensic-pathways.git
|
||||
cd forensic-pathways
|
||||
|
||||
# Dependencies installieren
|
||||
npm install
|
||||
|
||||
# Umgebungsvariablen konfigurieren
|
||||
cp .env.example .env
|
||||
# .env bearbeiten (siehe Konfiguration unten)
|
||||
|
||||
npm run astro build
|
||||
|
||||
# Development Server starten
|
||||
npm run dev
|
||||
scenarios:
|
||||
- id: scenario:memory_dump
|
||||
icon: 🧠
|
||||
friendly_name: RAM-Analyse
|
||||
```
|
||||
|
||||
Die Seite ist dann unter `http://localhost:4321` verfügbar.
|
||||
## AI Concept
|
||||
|
||||
### Produktions-Deployment
|
||||
### Micro-Task Architecture
|
||||
The AI system uses a sophisticated pipeline that breaks complex analysis into focused micro-tasks:
|
||||
|
||||
#### 1. System vorbereiten
|
||||
1. **Scenario Analysis**: Understanding the forensic context
|
||||
2. **Investigation Approach**: Determining optimal methodology
|
||||
3. **Critical Considerations**: Identifying potential challenges
|
||||
4. **Tool Selection**: Phase-specific or problem-specific recommendations
|
||||
5. **Background Knowledge**: Relevant concepts and prerequisites
|
||||
6. **Final Synthesis**: Integrated recommendations with confidence scoring
|
||||
|
||||
### Confidence Scoring
|
||||
Each recommendation includes transparent confidence metrics:
|
||||
- **Semantic Relevance**: Vector similarity between query and tool descriptions
|
||||
- **Task Suitability**: AI-assessed fitness for the specific scenario
|
||||
- **Uncertainty Factors**: Potential limitations and considerations
|
||||
- **Strength Indicators**: Why the tool is well-suited
|
||||
|
||||
## NIST SP 800-86 Phases
|
||||
|
||||
The system organizes tools according to the four-phase NIST methodology:
|
||||
|
||||
1. **Data Collection**: Imaging, acquisition, and evidence preservation
|
||||
2. **Examination**: Parsing, extraction, and initial data processing
|
||||
3. **Analysis**: Deep investigation, correlation, and insight generation
|
||||
4. **Reporting**: Documentation, visualization, and presentation
|
||||
|
||||
Each tool is mapped to appropriate phases, enabling workflow-based recommendations.
|
||||
|
||||
## Deployment
|
||||
|
||||
### Production Setup
|
||||
|
||||
1. **Build and Deploy**:
|
||||
```bash
|
||||
# System-Updates
|
||||
sudo apt update && sudo apt upgrade -y
|
||||
|
||||
# Node.js installieren (Ubuntu/Debian)
|
||||
curl -fsSL https://deb.nodesource.com/setup_18.x | sudo -E bash -
|
||||
sudo apt-get install -y nodejs
|
||||
|
||||
# Nginx installieren
|
||||
sudo apt install nginx -y
|
||||
|
||||
# Systemd für Service-Management
|
||||
sudo systemctl enable nginx
|
||||
npm run build
|
||||
sudo ./deploy.sh # Copies dist/ to /var/www/forensic-pathways
|
||||
```
|
||||
|
||||
#### 2. Anwendung installieren
|
||||
|
||||
2. **Configuration**:
|
||||
```bash
|
||||
# Klonen des Repositorys
|
||||
sudo git clone https://git.cc24.dev/mstoeck3/forensic-pathways /opt/forensic-pathways
|
||||
cd /opt/forensic-pathways
|
||||
|
||||
# Abhängigkeiten installieren
|
||||
sudo npm install
|
||||
|
||||
# Production-Build erstellen
|
||||
sudo npm run build
|
||||
npm run astro build
|
||||
|
||||
# Berechtigungen setzen
|
||||
sudo chown -R www-data:www-data /opt/forensic-pathways
|
||||
cd /var/www/forensic-pathways
|
||||
sudo cp .env.example .env
|
||||
sudo nano .env # Configure AI services, authentication, etc.
|
||||
```
|
||||
|
||||
#### 3. Umgebungsvariablen konfigurieren
|
||||
3. **Systemd Service** (`/etc/systemd/system/forensic-pathways.service`):
|
||||
```ini
|
||||
[Unit]
|
||||
Description=ForensicPathways
|
||||
After=network.target
|
||||
|
||||
Erstelle `/opt/forensic-pathways/.env`:
|
||||
[Service]
|
||||
Type=simple
|
||||
User=www-data
|
||||
WorkingDirectory=/var/www/forensic-pathways
|
||||
ExecStart=/usr/bin/node server/entry.mjs
|
||||
Restart=always
|
||||
RestartSec=10
|
||||
Environment=NODE_ENV=production
|
||||
|
||||
```bash
|
||||
# ===========================================
|
||||
# ForensicPathways Environment Configuration
|
||||
# ===========================================
|
||||
|
||||
# Authentication & OIDC (Required)
|
||||
AUTH_SECRET=change-this-to-a-strong-secret-key-in-production
|
||||
OIDC_ENDPOINT=https://your-oidc-provider.com
|
||||
OIDC_CLIENT_ID=your-oidc-client-id
|
||||
OIDC_CLIENT_SECRET=your-oidc-client-secret
|
||||
|
||||
# Auth Scopes - set to true in prod
|
||||
AUTHENTICATION_NECESSARY_CONTRIBUTIONS=true
|
||||
AUTHENTICATION_NECESSARY_AI=true
|
||||
|
||||
# Application Configuration (Required)
|
||||
PUBLIC_BASE_URL=https://your-domain.com
|
||||
NODE_ENV=production
|
||||
|
||||
# AI Service Configuration (Required for AI features)
|
||||
AI_ANALYZER_MODEL=mistral-large-latest
|
||||
AI_ANALYZER_ENDPOINT=https://api.mistral.ai
|
||||
AI_ANALYZER_API_KEY=your-mistral-api-key
|
||||
AI_RATE_LIMIT_DELAY_MS=1000
|
||||
|
||||
# Git Integration (Required for contributions)
|
||||
GIT_REPO_URL=https://git.cc24.dev/mstoeck3/forensic-pathways
|
||||
GIT_PROVIDER=gitea
|
||||
GIT_API_ENDPOINT=https://git.cc24.dev/api/v1
|
||||
GIT_API_TOKEN=your-git-api-token
|
||||
|
||||
# File Upload Configuration (Optional)
|
||||
LOCAL_UPLOAD_PATH=./public/uploads
|
||||
|
||||
# Nextcloud Integration (Optional)
|
||||
NEXTCLOUD_ENDPOINT=https://your-nextcloud.com
|
||||
NEXTCLOUD_USERNAME=your-username
|
||||
NEXTCLOUD_PASSWORD=your-password
|
||||
NEXTCLOUD_UPLOAD_PATH=/kb-media
|
||||
NEXTCLOUD_PUBLIC_URL=https://your-nextcloud.com/s/
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
```
|
||||
|
||||
```bash
|
||||
# Berechtigungen sichern
|
||||
sudo chmod 600 /opt/forensic-pathways/.env
|
||||
sudo chown www-data:www-data /opt/forensic-pathways/.env
|
||||
```
|
||||
|
||||
#### 4. Nginx konfigurieren
|
||||
|
||||
Erstelle `/etc/nginx/sites-available/forensic-pathways`:
|
||||
|
||||
4. **Nginx Configuration**:
|
||||
```nginx
|
||||
server {
|
||||
listen 80;
|
||||
server_name ihre-domain.de;
|
||||
server_name forensic-pathways.yourdomain.com;
|
||||
|
||||
# Redirect HTTP to HTTPS
|
||||
return 301 https://$server_name$request_uri;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
server_name ihre-domain.de;
|
||||
|
||||
# SSL Konfiguration (Let's Encrypt empfohlen)
|
||||
ssl_certificate /etc/letsencrypt/live/ihre-domain.de/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/ihre-domain.de/privkey.pem;
|
||||
|
||||
# Security Headers
|
||||
add_header X-Frame-Options DENY;
|
||||
add_header X-Content-Type-Options nosniff;
|
||||
add_header X-XSS-Protection "1; mode=block";
|
||||
add_header Referrer-Policy "strict-origin-when-cross-origin";
|
||||
|
||||
# Static Files
|
||||
location / {
|
||||
try_files $uri $uri/ @nodejs;
|
||||
root /opt/forensic-pathways/dist;
|
||||
index index.html;
|
||||
|
||||
# Cache static assets
|
||||
location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff2?|ttf)$ {
|
||||
expires 1y;
|
||||
add_header Cache-Control "public, immutable";
|
||||
}
|
||||
}
|
||||
|
||||
# API Routes to Node.js
|
||||
location @nodejs {
|
||||
proxy_pass http://localhost:4321;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
@ -236,251 +153,162 @@ server {
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_cache_bypass $http_upgrade;
|
||||
proxy_read_timeout 300s;
|
||||
proxy_connect_timeout 75s;
|
||||
}
|
||||
|
||||
# Upload limit
|
||||
client_max_body_size 50M;
|
||||
}
|
||||
```
|
||||
|
||||
5. **Enable and Start**:
|
||||
```bash
|
||||
# Site aktivieren
|
||||
sudo ln -s /etc/nginx/sites-available/forensic-pathways /etc/nginx/sites-enabled/
|
||||
sudo nginx -t
|
||||
sudo systemctl enable forensic-pathways
|
||||
sudo systemctl start forensic-pathways
|
||||
sudo systemctl reload nginx
|
||||
```
|
||||
|
||||
#### 5. Systemd Service einrichten
|
||||
### Environment Configuration
|
||||
|
||||
Erstelle `/etc/systemd/system/forensic-pathways.service`:
|
||||
|
||||
```ini
|
||||
[Unit]
|
||||
Description=ForensicPathways DFIR Guide
|
||||
After=network.target nginx.service
|
||||
Wants=nginx.service
|
||||
|
||||
[Service]
|
||||
Type=exec
|
||||
User=www-data
|
||||
Group=www-data
|
||||
WorkingDirectory=/opt/forensic-pathways
|
||||
Environment=NODE_ENV=production
|
||||
ExecStart=/usr/bin/node ./dist/server/entry.mjs
|
||||
Restart=always
|
||||
RestartSec=10
|
||||
StandardOutput=journal
|
||||
StandardError=journal
|
||||
|
||||
# Security
|
||||
NoNewPrivileges=yes
|
||||
PrivateTmp=yes
|
||||
ProtectSystem=strict
|
||||
ProtectHome=yes
|
||||
ReadWritePaths=/opt/forensic-pathways
|
||||
CapabilityBoundingSet=
|
||||
|
||||
# Resource Limits
|
||||
LimitNOFILE=65536
|
||||
MemoryMax=512M
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
```
|
||||
Key configuration in `.env`:
|
||||
|
||||
```bash
|
||||
# Service aktivieren und starten
|
||||
sudo systemctl daemon-reload
|
||||
sudo systemctl enable forensic-pathways
|
||||
sudo systemctl start forensic-pathways
|
||||
# Core Application
|
||||
PUBLIC_BASE_URL=https://forensic-pathways.yourdomain.com
|
||||
AUTH_SECRET=your-secure-random-secret
|
||||
|
||||
# Status prüfen
|
||||
sudo systemctl status forensic-pathways
|
||||
# AI Services (Required)
|
||||
AI_ANALYZER_ENDPOINT=https://api.mistral.ai/v1/chat/completions
|
||||
AI_ANALYZER_API_KEY=your-api-key
|
||||
AI_ANALYZER_MODEL=mistral/mistral-small-latest
|
||||
|
||||
# Vector Embeddings (Recommended)
|
||||
AI_EMBEDDINGS_ENABLED=true
|
||||
AI_EMBEDDINGS_ENDPOINT=https://api.mistral.ai/v1/embeddings
|
||||
AI_EMBEDDINGS_MODEL=mistral-embed
|
||||
|
||||
# Authentication (Optional)
|
||||
AUTHENTICATION_NECESSARY_AI=false
|
||||
OIDC_ENDPOINT=https://your-keycloak.com/auth/realms/your-realm
|
||||
OIDC_CLIENT_ID=forensic-pathways
|
||||
```
|
||||
|
||||
## 🔧 Konfiguration
|
||||
## Externe Abhängigkeiten (Optionale Features)
|
||||
|
||||
### Minimalkonfiguration (ohne Auth)
|
||||
### File-Upload-System
|
||||
- **Nextcloud**: Primärer Speicher für Beitrags-Anhänge
|
||||
- **Lokaler Fallback**: Automatischer Fallback zu lokalem Speicher bei Nextcloud-Ausfall
|
||||
|
||||
### Authentifizierungsanbieter
|
||||
- **Keycloak**: Empfohlener OIDC-Provider
|
||||
- **Andere OIDC**: Jeder OIDC-konforme Provider (Auth0, Azure AD, etc.)
|
||||
|
||||
### Git-Integration
|
||||
- **Gitea**: Primärer Git-Provider für Beiträge
|
||||
- **GitHub/GitLab**: Alternative Git-Provider unterstützt
|
||||
|
||||
### Monitoring
|
||||
- **Uptime Kuma**: Service-Monitoring und Gesundheitschecks (optional)
|
||||
|
||||
### KI-Services
|
||||
- **Mistral AI**: Empfohlen für Produktion (API-Schlüssel erforderlich)
|
||||
- **Ollama**: Lokale Deployment-Option (kein API-Schlüssel benötigt)
|
||||
- **OpenAI**: Alternative kommerzielle Anbieter
|
||||
|
||||
## Knowledgebase-System
|
||||
|
||||
### Artikel hinzufügen
|
||||
|
||||
Knowledgebase-Artikel werden in `src/content/knowledgebase/` als Markdown-Dateien mit Frontmatter gespeichert:
|
||||
|
||||
```markdown
|
||||
---
|
||||
title: "Tool-Konfigurationsanleitung"
|
||||
description: "Schritt-für-Schritt-Setup-Anweisungen"
|
||||
last_updated: 2024-01-15
|
||||
author: "Ihr Name"
|
||||
difficulty: intermediate
|
||||
|
||||
# Tool-Zuordnung (optional)
|
||||
tool_name: "Autopsy"
|
||||
related_tools: ["Volatility 3", "YARA"]
|
||||
|
||||
# Kategorisierung
|
||||
categories: ["konfiguration", "setup"]
|
||||
tags: ["gui", "installation", "windows"]
|
||||
|
||||
published: true
|
||||
---
|
||||
|
||||
# Tool-Konfigurationsanleitung
|
||||
|
||||
Ihr Artikel-Inhalt hier...
|
||||
|
||||
## Voraussetzungen
|
||||
- Systemanforderungen
|
||||
- Abhängigkeiten
|
||||
|
||||
## Installationsschritte
|
||||
1. Download von offizieller Quelle
|
||||
2. Installer ausführen
|
||||
3. Einstellungen konfigurieren
|
||||
|
||||
## Häufige Probleme
|
||||
Lösungen für typische Probleme...
|
||||
```
|
||||
|
||||
### Artikel-Struktur-Richtlinien
|
||||
|
||||
**Erforderliche Felder**:
|
||||
- `title`: Klarer, beschreibender Titel
|
||||
- `description`: Einzeilige Zusammenfassung für Auflistungen
|
||||
- `last_updated`: Artikel-Änderungsdatum
|
||||
- `published`: Boolean-Flag für Sichtbarkeit
|
||||
|
||||
**Optionale Felder**:
|
||||
- `tool_name`: Zuordnung zu spezifischem Tool aus Datenbank
|
||||
- `author`: Mitwirkender Name (Standard: "Anon")
|
||||
- `difficulty`: Komplexitätslevel passend zu Tool-Skill-Levels
|
||||
- `categories`: Breite Klassifizierungen
|
||||
- `tags`: Spezifische Stichwörter für Entdeckung
|
||||
- `related_tools`: Array verwandter Tool-Namen
|
||||
|
||||
**Inhalt-Richtlinien**:
|
||||
- Standard-Markdown-Formatierung verwenden
|
||||
- Praktische Beispiele und Code-Snippets einschließen
|
||||
- Screenshots oder Diagramme bei Bedarf hinzufügen
|
||||
- Zu verwandten Tools mit `[Tool Name](/tools/tool-slug)` Format verlinken
|
||||
- Troubleshooting-Abschnitte für komplexe Tools einschließen
|
||||
|
||||
### Automatische Verarbeitung
|
||||
|
||||
1. Artikel werden automatisch beim Build indexiert
|
||||
2. Tool-Zuordnungen erstellen bidirektionale Links
|
||||
3. Suche umfasst Volltext-Inhalt und Metadaten
|
||||
4. Verwandte Artikel erscheinen in Tool-Detail-Ansichten
|
||||
|
||||
## Entwicklung
|
||||
|
||||
```bash
|
||||
# Nur für Tests geeignet
|
||||
AUTHENTICATION_NECESSARY=false
|
||||
PUBLIC_BASE_URL=http://localhost:4321
|
||||
# Setup
|
||||
npm install
|
||||
cp .env.example .env
|
||||
|
||||
# Entwicklung
|
||||
npm run dev
|
||||
|
||||
# Build
|
||||
npm run build
|
||||
|
||||
# Deploy
|
||||
sudo ./deploy.sh
|
||||
```
|
||||
|
||||
### Tools-Datenbank
|
||||
## Konfigurationsübersicht
|
||||
|
||||
Die Tools werden in `src/data/tools.yaml` verwaltet. Vollständiges Beispiel:
|
||||
Die `.env.example`-Datei enthält umfassende Konfigurationsoptionen für alle Features. Die meisten Optionen haben sinnvolle Standardwerte, wobei nur die KI-Service-Konfiguration für volle Funktionalität erforderlich ist.
|
||||
|
||||
```yaml
|
||||
tools:
|
||||
- name: Autopsy
|
||||
type: software # software|method|concept
|
||||
description: >-
|
||||
Die führende Open-Source-Alternative zu kommerziellen Forensik-Suiten mit
|
||||
intuitiver grafischer Oberfläche. Besonders stark in der Timeline-Analyse,
|
||||
Keyword-Suche und dem Carving gelöschter Dateien. Die modulare
|
||||
Plugin-Architektur erlaubt Erweiterungen für spezielle
|
||||
Untersuchungsszenarien.
|
||||
icon: 📦
|
||||
skillLevel: intermediate # novice|beginner|intermediate|advanced|expert
|
||||
url: https://www.autopsy.com/
|
||||
domains:
|
||||
- incident-response
|
||||
- static-investigations
|
||||
- malware-analysis
|
||||
- mobile-forensics
|
||||
- cloud-forensics
|
||||
phases:
|
||||
- examination
|
||||
- analysis
|
||||
platforms:
|
||||
- Windows
|
||||
- Linux
|
||||
related_concepts:
|
||||
- SQL Query Fundamentals
|
||||
- Hash Functions & Digital Signatures
|
||||
accessType: download # download|web|api|cli|service
|
||||
license: Apache 2.0
|
||||
knowledgebase: false # true für erweiterte Dokumentation
|
||||
tags:
|
||||
- gui
|
||||
- filesystem
|
||||
- timeline-analysis
|
||||
- carving
|
||||
- artifact-extraction
|
||||
- keyword-search
|
||||
# Optional: Für gehostete Services
|
||||
projectUrl: https://autopsy.ihre-domain.de
|
||||
statusUrl: https://status.ihre-domain.de/api/badge/1/status
|
||||
|
||||
# Beispiel Methode
|
||||
- name: Live Response Methodology
|
||||
type: method
|
||||
description: >-
|
||||
Strukturierte Vorgehensweise zur Sammlung volatiler Daten
|
||||
von laufenden Systemen ohne Shutdown.
|
||||
icon: 📋
|
||||
skillLevel: advanced
|
||||
url: https://www.sans.org/white-papers/live-response/
|
||||
domains:
|
||||
- incident-response
|
||||
phases:
|
||||
- data-collection
|
||||
related_concepts:
|
||||
- Memory Forensics Fundamentals
|
||||
tags:
|
||||
- volatile-data
|
||||
- live-analysis
|
||||
- methodology
|
||||
knowledgebase: true
|
||||
|
||||
# Beispiel Konzept
|
||||
- name: Hash Functions & Digital Signatures
|
||||
type: concept
|
||||
description: >-
|
||||
Kryptographische Grundlagen für Datenintegrität und
|
||||
Authentifizierung in der digitalen Forensik.
|
||||
icon: 🔐
|
||||
skillLevel: intermediate
|
||||
url: https://en.wikipedia.org/wiki/Cryptographic_hash_function
|
||||
domains:
|
||||
- incident-response
|
||||
- static-investigations
|
||||
- malware-analysis
|
||||
phases:
|
||||
- data-collection
|
||||
- examination
|
||||
tags:
|
||||
- cryptography
|
||||
- data-integrity
|
||||
- evidence-preservation
|
||||
knowledgebase: false
|
||||
## Architektur
|
||||
|
||||
# Konfiguration der Domänen
|
||||
domains:
|
||||
- id: incident-response
|
||||
name: Incident Response & Breach-Untersuchung
|
||||
- id: static-investigations
|
||||
name: Datenträgerforensik & Ermittlungen
|
||||
- id: malware-analysis
|
||||
name: Malware-Analyse & Reverse Engineering
|
||||
- id: mobile-forensics
|
||||
name: Mobile Geräte & App-Forensik
|
||||
- id: cloud-forensics
|
||||
name: Cloud & Virtuelle Umgebungen
|
||||
|
||||
# Konfiguration der Phasen (NIST Framework)
|
||||
phases:
|
||||
- id: data-collection
|
||||
name: Datensammlung
|
||||
description: Imaging, Acquisition, Remote Collection Tools
|
||||
- id: examination
|
||||
name: Auswertung
|
||||
description: Parsing, Extraction, Initial Analysis Tools
|
||||
- id: analysis
|
||||
name: Analyse
|
||||
description: Deep Analysis, Correlation, Visualization Tools
|
||||
- id: reporting
|
||||
name: Bericht & Präsentation
|
||||
description: Documentation, Visualization, Presentation Tools
|
||||
|
||||
# Domänenübergreifende Kategorien
|
||||
domain-agnostic-software:
|
||||
- id: collaboration-general
|
||||
name: Übergreifend & Kollaboration
|
||||
description: Cross-cutting tools and collaboration platforms
|
||||
- id: specific-os
|
||||
name: Betriebssysteme
|
||||
description: Operating Systems which focus on forensics
|
||||
```
|
||||
|
||||
## 📦 Updates
|
||||
|
||||
```bash
|
||||
# Repository aktualisieren
|
||||
cd /opt/forensic-pathways
|
||||
sudo git pull
|
||||
|
||||
# Dependencies aktualisieren
|
||||
sudo npm install
|
||||
|
||||
# Rebuild
|
||||
sudo npm run build
|
||||
|
||||
# Service neustarten
|
||||
sudo systemctl restart forensic-pathways
|
||||
```
|
||||
|
||||
## 💾 Backup
|
||||
|
||||
Wichtige Dateien für Backup:
|
||||
|
||||
```bash
|
||||
/opt/forensic-pathways/src/data/tools.yaml
|
||||
/opt/forensic-pathways/.env
|
||||
/etc/nginx/sites-available/forensic-pathways
|
||||
/etc/systemd/system/forensic-pathways.service
|
||||
```
|
||||
|
||||
## 🤝 Beiträge
|
||||
|
||||
Contributions sind willkommen! Bitte:
|
||||
|
||||
1. Issue im Repository erstellen
|
||||
2. Feature-Branch erstellen
|
||||
3. Pull Request öffnen
|
||||
4. Tests durchführen
|
||||
|
||||
## 📞 Support
|
||||
|
||||
Bei Problemen oder Fragen:
|
||||
|
||||
- **Issues:** [Repository Issues](https://git.cc24.dev/mstoeck3/forensic-pathways/issues)
|
||||
- **Dokumentation:** Siehe `/knowledgebase` auf der Website
|
||||
|
||||
## 📄 Lizenz
|
||||
|
||||
Dieses Projekt steht unter der **BSD-3-Clause** Lizenz.
|
||||
- **Frontend**: Astro mit TypeScript, responsive CSS
|
||||
- **Backend**: Node.js API-Routen mit intelligenter Ratenbegrenzung
|
||||
- **KI-Pipeline**: Micro-Task-Architektur mit Audit-Protokollierung
|
||||
- **Daten**: YAML-basierte Tool-Datenbank mit Git-basierten Beiträgen
|
||||
- **Suche**: Dual-Mode Text- und semantische Vector-Suche
|
||||
- **Auth**: OIDC-Integration mit Session-Management
|
||||
Loading…
x
Reference in New Issue
Block a user