change framework
This commit is contained in:
@@ -1,85 +0,0 @@
|
||||
# File: ./src/data/services.yaml
|
||||
# Service Status Configuration
|
||||
# This file configures the services monitored on the status page
|
||||
# Connect to Uptime Kuma API for real-time data
|
||||
|
||||
# Uptime Kuma Configuration
|
||||
uptimeKuma:
|
||||
enabled: false # Set to true when Uptime Kuma is configured
|
||||
apiUrl: "https://status.lab.local/api"
|
||||
apiKey: "" # Add your Uptime Kuma API key here
|
||||
refreshInterval: 30000 # Refresh every 30 seconds
|
||||
|
||||
# Static service definitions (used when Uptime Kuma is not available)
|
||||
services:
|
||||
- id: timesketch
|
||||
name: "Timesketch Instance"
|
||||
description: "Collaborative forensic timeline analysis platform"
|
||||
url: "https://timesketch.lab.local"
|
||||
category: "Analysis Tools"
|
||||
status: "operational" # operational|degraded|maintenance|down
|
||||
uptime: "99.9%"
|
||||
responseTime: "245ms"
|
||||
lastChecked: "2025-01-15T10:30:00Z"
|
||||
|
||||
- id: thehive
|
||||
name: "TheHive Platform"
|
||||
description: "Incident response and case management"
|
||||
url: "https://thehive.lab.local"
|
||||
category: "Case Management"
|
||||
status: "operational"
|
||||
uptime: "99.7%"
|
||||
responseTime: "180ms"
|
||||
lastChecked: "2025-01-15T10:30:00Z"
|
||||
|
||||
- id: misp
|
||||
name: "MISP Instance"
|
||||
description: "Threat intelligence sharing platform"
|
||||
url: "https://misp.lab.local"
|
||||
category: "Threat Intelligence"
|
||||
status: "degraded"
|
||||
uptime: "98.2%"
|
||||
responseTime: "890ms"
|
||||
lastChecked: "2025-01-15T10:29:00Z"
|
||||
issues: "High response times due to database optimization"
|
||||
|
||||
- id: elasticsearch
|
||||
name: "Elasticsearch Cluster"
|
||||
description: "Search and analytics engine"
|
||||
url: "https://elastic.lab.local"
|
||||
category: "Infrastructure"
|
||||
status: "operational"
|
||||
uptime: "99.8%"
|
||||
responseTime: "120ms"
|
||||
lastChecked: "2025-01-15T10:30:00Z"
|
||||
|
||||
- id: neo4j
|
||||
name: "Neo4j Database"
|
||||
description: "Graph database for relationship analysis"
|
||||
url: "https://neo4j.lab.local"
|
||||
category: "Infrastructure"
|
||||
status: "maintenance"
|
||||
uptime: "97.1%"
|
||||
responseTime: "N/A"
|
||||
lastChecked: "2025-01-15T09:00:00Z"
|
||||
issues: "Scheduled maintenance window: 09:00-11:00 UTC"
|
||||
|
||||
# Service categories for organization
|
||||
categories:
|
||||
- name: "Analysis Tools"
|
||||
description: "Forensic analysis and timeline tools"
|
||||
- name: "Case Management"
|
||||
description: "Incident response and case tracking"
|
||||
- name: "Threat Intelligence"
|
||||
description: "IOC sharing and threat analysis"
|
||||
- name: "Infrastructure"
|
||||
description: "Backend services and databases"
|
||||
|
||||
# Overall status calculation
|
||||
overall:
|
||||
status: "partial_outage" # operational|degraded|partial_outage|major_outage
|
||||
message: "4 of 5 services operational • 1 service under maintenance"
|
||||
operationalCount: 3
|
||||
degradedCount: 1
|
||||
maintenanceCount: 1
|
||||
downCount: 0
|
||||
@@ -1,196 +1,312 @@
|
||||
# File: ./src/data/tools.yaml
|
||||
# DFIR Tools Database
|
||||
# Edit this file to add, remove, or modify tools
|
||||
# Structure: Each tool should have required fields marked with *
|
||||
# Each tool can appear in multiple domains and phases
|
||||
# Self-hosted services have isHosted: true and statusUrl for monitoring
|
||||
|
||||
tools:
|
||||
- id: sleuthkit
|
||||
name: "The Sleuth Kit" # * Display name
|
||||
description: "Collection of command line tools for digital forensic analysis" # * Brief description
|
||||
domains: # * Array of forensic domains
|
||||
- "Filesystem Forensics"
|
||||
phases: # * Array of DFIR phases
|
||||
- "Examination"
|
||||
- "Analysis"
|
||||
platforms: # * Supported platforms
|
||||
- "Linux"
|
||||
- "Windows"
|
||||
- "macOS"
|
||||
skillLevel: "Intermediate" # * Beginner|Intermediate|Advanced
|
||||
accessType: "CLI" # * CLI|GUI|Web|SaaS
|
||||
url: "https://sleuthkit.org" # * Project homepage
|
||||
tags: # Optional tags for search
|
||||
- "timeline"
|
||||
- "file-recovery"
|
||||
- "metadata"
|
||||
type: "FOSS" # * FOSS|SaaS
|
||||
|
||||
- id: volatility
|
||||
name: "Volatility"
|
||||
description: "Advanced memory forensics framework"
|
||||
domains:
|
||||
- "Memory Forensics"
|
||||
- "Live Forensics"
|
||||
- name: "Autopsy"
|
||||
description: "Open source digital forensics platform with a graphical interface"
|
||||
domains:
|
||||
- "storage-file-system"
|
||||
- "application-code"
|
||||
phases:
|
||||
- "Examination"
|
||||
- "Analysis"
|
||||
platforms:
|
||||
- "Linux"
|
||||
- "Windows"
|
||||
- "macOS"
|
||||
skillLevel: "Advanced"
|
||||
accessType: "CLI"
|
||||
url: "https://volatilityfoundation.org"
|
||||
tags:
|
||||
- "memory-analysis"
|
||||
- "malware-detection"
|
||||
- "process-analysis"
|
||||
type: "FOSS"
|
||||
- "examination"
|
||||
- "analysis"
|
||||
platforms: ["Windows", "Linux", "macOS"]
|
||||
skillLevel: "intermediate"
|
||||
accessType: "download"
|
||||
url: "https://www.autopsy.com/"
|
||||
license: "Apache 2.0"
|
||||
tags: ["disk-forensics", "file-recovery", "timeline-analysis"]
|
||||
isHosted: false
|
||||
|
||||
- id: wireshark
|
||||
name: "Wireshark"
|
||||
description: "Network protocol analyzer and packet capture tool"
|
||||
- name: "Volatility 3"
|
||||
description: "Advanced memory forensics framework for incident response and malware analysis"
|
||||
domains:
|
||||
- "Network Forensics"
|
||||
- "memory-runtime"
|
||||
phases:
|
||||
- "Examination"
|
||||
- "Reporting"
|
||||
platforms:
|
||||
- "Linux"
|
||||
- "Windows"
|
||||
- "macOS"
|
||||
skillLevel: "Intermediate"
|
||||
accessType: "GUI"
|
||||
url: "https://wireshark.org"
|
||||
tags:
|
||||
- "packet-analysis"
|
||||
- "network-traffic"
|
||||
- "protocol-dissection"
|
||||
type: "FOSS"
|
||||
- "examination"
|
||||
- "analysis"
|
||||
platforms: ["Windows", "Linux", "macOS"]
|
||||
skillLevel: "advanced"
|
||||
accessType: "download"
|
||||
url: "https://www.volatilityfoundation.org/"
|
||||
license: "VSL"
|
||||
tags: ["memory-forensics", "malware-analysis", "incident-response"]
|
||||
isHosted: false
|
||||
|
||||
- id: plaso
|
||||
name: "Plaso"
|
||||
description: "Super timeline all the things"
|
||||
- name: "TheHive"
|
||||
description: "Security incident response platform for SOCs, CERTs and security teams"
|
||||
domains:
|
||||
- "Filesystem Forensics"
|
||||
- "storage-file-system"
|
||||
- "network-communication"
|
||||
- "application-code"
|
||||
phases:
|
||||
- "Analysis"
|
||||
- "Reporting"
|
||||
platforms:
|
||||
- "Linux"
|
||||
- "Windows"
|
||||
- "macOS"
|
||||
skillLevel: "Advanced"
|
||||
accessType: "CLI"
|
||||
url: "https://plaso.readthedocs.io"
|
||||
tags:
|
||||
- "timeline"
|
||||
- "log-analysis"
|
||||
- "artifact-parsing"
|
||||
type: "FOSS"
|
||||
- "data-collection"
|
||||
- "examination"
|
||||
- "analysis"
|
||||
- "reporting"
|
||||
platforms: ["Web"]
|
||||
skillLevel: "intermediate"
|
||||
accessType: "self-hosted"
|
||||
url: "https://thehive.example.lab"
|
||||
license: "AGPL-3.0"
|
||||
tags: ["incident-response", "case-management", "collaboration"]
|
||||
isHosted: true
|
||||
statusUrl: "https://uptime.example.lab/api/badge/1/status"
|
||||
|
||||
- id: yara
|
||||
name: "YARA"
|
||||
description: "Pattern matching engine for malware research"
|
||||
- name: "MISP"
|
||||
description: "Malware Information Sharing Platform for threat intelligence"
|
||||
domains:
|
||||
- "Malware Analysis"
|
||||
- "Live Forensics"
|
||||
- "network-communication"
|
||||
- "application-code"
|
||||
phases:
|
||||
- "Data Collection"
|
||||
- "Analysis"
|
||||
platforms:
|
||||
- "Linux"
|
||||
- "Windows"
|
||||
- "macOS"
|
||||
skillLevel: "Advanced"
|
||||
accessType: "CLI"
|
||||
url: "https://virustotal.github.io/yara/"
|
||||
tags:
|
||||
- "pattern-matching"
|
||||
- "malware-detection"
|
||||
- "signatures"
|
||||
type: "FOSS"
|
||||
- "data-collection"
|
||||
- "analysis"
|
||||
- "reporting"
|
||||
platforms: ["Web"]
|
||||
skillLevel: "intermediate"
|
||||
accessType: "self-hosted"
|
||||
url: "https://misp.example.lab"
|
||||
license: "AGPL-3.0"
|
||||
tags: ["threat-intelligence", "ioc-sharing", "collaboration"]
|
||||
isHosted: true
|
||||
statusUrl: "https://uptime.example.lab/api/badge/2/status"
|
||||
|
||||
# Self-hosted services (what you call "SaaS Tools")
|
||||
- id: timesketch
|
||||
name: "Timesketch"
|
||||
description: "Collaborative forensic timeline analysis"
|
||||
- name: "Timesketch"
|
||||
description: "Collaborative forensic timeline analysis platform"
|
||||
domains:
|
||||
- "Filesystem Forensics"
|
||||
- "Network Forensics"
|
||||
- "storage-file-system"
|
||||
- "network-communication"
|
||||
phases:
|
||||
- "Analysis"
|
||||
- "Reporting"
|
||||
platforms:
|
||||
- "Web"
|
||||
skillLevel: "Intermediate"
|
||||
accessType: "Web"
|
||||
url: "https://timesketch.org"
|
||||
tags:
|
||||
- "timeline"
|
||||
- "collaboration"
|
||||
- "visualization"
|
||||
type: "SaaS"
|
||||
selfHosted: true
|
||||
serviceUrl: "https://timesketch.lab.local" # Internal lab URL
|
||||
- "analysis"
|
||||
- "reporting"
|
||||
platforms: ["Web"]
|
||||
skillLevel: "intermediate"
|
||||
accessType: "self-hosted"
|
||||
url: "https://timesketch.example.lab"
|
||||
license: "Apache 2.0"
|
||||
tags: ["timeline-analysis", "collaboration", "visualization"]
|
||||
isHosted: true
|
||||
statusUrl: "https://uptime.example.lab/api/badge/3/status"
|
||||
|
||||
- id: thehive
|
||||
name: "TheHive"
|
||||
description: "Scalable incident response platform"
|
||||
- name: "Wireshark"
|
||||
description: "Network protocol analyzer for network troubleshooting and analysis"
|
||||
domains:
|
||||
- "Live Forensics"
|
||||
- "network-communication"
|
||||
phases:
|
||||
- "Data Collection"
|
||||
- "Analysis"
|
||||
- "Reporting"
|
||||
platforms:
|
||||
- "Web"
|
||||
skillLevel: "Intermediate"
|
||||
accessType: "Web"
|
||||
url: "https://thehive-project.org"
|
||||
tags:
|
||||
- "incident-response"
|
||||
- "case-management"
|
||||
- "collaboration"
|
||||
type: "SaaS"
|
||||
selfHosted: true
|
||||
serviceUrl: "https://thehive.lab.local"
|
||||
- "data-collection"
|
||||
- "examination"
|
||||
- "analysis"
|
||||
platforms: ["Windows", "Linux", "macOS"]
|
||||
skillLevel: "intermediate"
|
||||
accessType: "download"
|
||||
url: "https://www.wireshark.org/"
|
||||
license: "GPL-2.0"
|
||||
tags: ["network-analysis", "pcap", "protocol-analysis"]
|
||||
isHosted: false
|
||||
|
||||
- id: misp
|
||||
name: "MISP"
|
||||
description: "Threat intelligence sharing platform"
|
||||
- name: "EnCase"
|
||||
description: "Commercial digital investigation platform"
|
||||
domains:
|
||||
- "Malware Analysis"
|
||||
- "Live Forensics"
|
||||
- "storage-file-system"
|
||||
- "memory-runtime"
|
||||
phases:
|
||||
- "Analysis"
|
||||
- "Reporting"
|
||||
platforms:
|
||||
- "Web"
|
||||
skillLevel: "Advanced"
|
||||
accessType: "Web"
|
||||
url: "https://misp-project.org"
|
||||
tags:
|
||||
- "threat-intelligence"
|
||||
- "ioc-sharing"
|
||||
- "attribution"
|
||||
type: "SaaS"
|
||||
selfHosted: true
|
||||
serviceUrl: "https://misp.lab.local"
|
||||
- "data-collection"
|
||||
- "examination"
|
||||
- "analysis"
|
||||
- "reporting"
|
||||
platforms: ["Windows"]
|
||||
skillLevel: "advanced"
|
||||
accessType: "commercial"
|
||||
url: "https://www.opentext.com/products/encase-forensic"
|
||||
license: "Proprietary"
|
||||
tags: ["commercial", "enterprise", "court-approved"]
|
||||
isHosted: false
|
||||
|
||||
- name: "Cuckoo Sandbox"
|
||||
description: "Automated malware analysis system using virtualization"
|
||||
domains:
|
||||
- "application-code"
|
||||
- "network-communication"
|
||||
phases:
|
||||
- "examination"
|
||||
- "analysis"
|
||||
platforms: ["Linux"]
|
||||
skillLevel: "advanced"
|
||||
accessType: "self-hosted"
|
||||
url: "https://cuckoosandbox.org/"
|
||||
license: "GPL-3.0"
|
||||
tags: ["malware-analysis", "sandbox", "dynamic-analysis"]
|
||||
isHosted: true
|
||||
statusUrl: ""
|
||||
|
||||
# Additional metadata
|
||||
metadata:
|
||||
lastUpdated: "2025-01-15"
|
||||
totalTools: 8
|
||||
domains:
|
||||
- "Filesystem Forensics"
|
||||
- "Network Forensics"
|
||||
- "Memory Forensics"
|
||||
- "Live Forensics"
|
||||
- "Malware Analysis"
|
||||
- "Cryptocurrency"
|
||||
phases:
|
||||
- "Data Collection"
|
||||
- "Examination"
|
||||
- "Analysis"
|
||||
- "Reporting"
|
||||
- name: "FTK Imager"
|
||||
description: "Forensic imaging and preview tool by Exterro"
|
||||
domains:
|
||||
- "storage-file-system"
|
||||
phases:
|
||||
- "data-collection"
|
||||
- "examination"
|
||||
platforms: ["Windows"]
|
||||
skillLevel: "intermediate"
|
||||
accessType: "download"
|
||||
url: "https://exterro.com/ftk-imager"
|
||||
license: "Proprietary"
|
||||
tags: ["disk-imaging", "preview", "data-acquisition"]
|
||||
isHosted: false
|
||||
|
||||
- name: "GRR Rapid Response"
|
||||
description: "Remote live forensics platform by Google"
|
||||
domains:
|
||||
- "platform-infrastructure"
|
||||
- "storage-file-system"
|
||||
phases:
|
||||
- "data-collection"
|
||||
- "examination"
|
||||
platforms: ["Linux", "Windows"]
|
||||
skillLevel: "advanced"
|
||||
accessType: "self-hosted"
|
||||
url: "https://github.com/google/grr"
|
||||
license: "Apache 2.0"
|
||||
tags: ["live-forensics", "remote-response", "dfir"]
|
||||
isHosted: true
|
||||
statusUrl: ""
|
||||
|
||||
- name: "Plaso (log2timeline)"
|
||||
description: "Tool for automatic creation of timelines from various log files"
|
||||
domains:
|
||||
- "storage-file-system"
|
||||
- "application-code"
|
||||
phases:
|
||||
- "analysis"
|
||||
platforms: ["Linux", "Windows", "macOS"]
|
||||
skillLevel: "intermediate"
|
||||
accessType: "download"
|
||||
url: "https://plaso.readthedocs.io/"
|
||||
license: "Apache 2.0"
|
||||
tags: ["timeline-analysis", "log-parsing", "dfir"]
|
||||
isHosted: false
|
||||
|
||||
- name: "NetworkMiner"
|
||||
description: "Network forensic analysis tool (NFAT)"
|
||||
domains:
|
||||
- "network-communication"
|
||||
phases:
|
||||
- "examination"
|
||||
- "analysis"
|
||||
platforms: ["Windows", "Linux (Mono)"]
|
||||
skillLevel: "intermediate"
|
||||
accessType: "download"
|
||||
url: "https://www.netresec.com/?page=NetworkMiner"
|
||||
license: "Freeware/Commercial"
|
||||
tags: ["pcap-analysis", "passive-sniffing", "credential-recovery"]
|
||||
isHosted: false
|
||||
|
||||
- name: "Redline"
|
||||
description: "Memory and host analysis tool from FireEye"
|
||||
domains:
|
||||
- "memory-runtime"
|
||||
- "application-code"
|
||||
phases:
|
||||
- "examination"
|
||||
- "analysis"
|
||||
platforms: ["Windows"]
|
||||
skillLevel: "intermediate"
|
||||
accessType: "download"
|
||||
url: "https://www.mandiant.com/resources/download/redline"
|
||||
license: "Proprietary"
|
||||
tags: ["memory-analysis", "ioc-scan", "host-analysis"]
|
||||
isHosted: false
|
||||
|
||||
- name: "KAPE"
|
||||
description: "Triage tool to collect and parse forensic artifacts quickly"
|
||||
domains:
|
||||
- "storage-file-system"
|
||||
- "platform-infrastructure"
|
||||
phases:
|
||||
- "data-collection"
|
||||
- "analysis"
|
||||
platforms: ["Windows"]
|
||||
skillLevel: "intermediate"
|
||||
accessType: "download"
|
||||
url: "https://www.kroll.com/en/services/cyber-risk/incident-response-litigation-support/kroll-artifact-parser-extractor-kape"
|
||||
license: "Freeware"
|
||||
tags: ["triage", "artifact-collection", "parsing"]
|
||||
isHosted: false
|
||||
|
||||
- name: "Velociraptor"
|
||||
description: "Endpoint visibility and DFIR tool by Rapid7"
|
||||
domains:
|
||||
- "platform-infrastructure"
|
||||
- "storage-file-system"
|
||||
phases:
|
||||
- "data-collection"
|
||||
- "examination"
|
||||
platforms: ["Windows", "Linux", "macOS"]
|
||||
skillLevel: "advanced"
|
||||
accessType: "self-hosted"
|
||||
url: "https://www.velociraptor.app/"
|
||||
license: "Apache 2.0"
|
||||
tags: ["dfir", "hunting", "endpoint-monitoring"]
|
||||
isHosted: true
|
||||
statusUrl: ""
|
||||
|
||||
- name: "Arkime"
|
||||
description: "Large-scale full packet capture and analysis"
|
||||
domains:
|
||||
- "network-communication"
|
||||
phases:
|
||||
- "data-collection"
|
||||
- "analysis"
|
||||
platforms: ["Linux"]
|
||||
skillLevel: "advanced"
|
||||
accessType: "self-hosted"
|
||||
url: "https://arkime.com/"
|
||||
license: "Apache 2.0"
|
||||
tags: ["packet-capture", "full-packet-analysis", "network-forensics"]
|
||||
isHosted: true
|
||||
statusUrl: ""
|
||||
|
||||
- name: "X-Ways Forensics"
|
||||
description: "Advanced work environment for computer forensic examiners"
|
||||
domains:
|
||||
- "storage-file-system"
|
||||
phases:
|
||||
- "examination"
|
||||
- "analysis"
|
||||
- "reporting"
|
||||
platforms: ["Windows"]
|
||||
skillLevel: "advanced"
|
||||
accessType: "commercial"
|
||||
url: "https://www.x-ways.net/forensics/"
|
||||
license: "Proprietary"
|
||||
tags: ["disk-forensics", "file-recovery", "commercial"]
|
||||
isHosted: false
|
||||
|
||||
# Domain definitions for reference
|
||||
domains:
|
||||
- id: "storage-file-system"
|
||||
name: "Storage & File System Artifacts"
|
||||
- id: "memory-runtime"
|
||||
name: "Memory & Runtime Artifacts"
|
||||
- id: "network-communication"
|
||||
name: "Network & Communication Artifacts"
|
||||
- id: "application-code"
|
||||
name: "Application & Code Artifacts"
|
||||
- id: "multimedia-content"
|
||||
name: "Multimedia & Content Artifacts"
|
||||
- id: "transaction-financial"
|
||||
name: "Transaction & Financial Artifacts"
|
||||
- id: "platform-infrastructure"
|
||||
name: "Platform & Infrastructure Artifacts"
|
||||
|
||||
# Phase definitions for reference
|
||||
phases:
|
||||
- id: "data-collection"
|
||||
name: "Data Collection"
|
||||
- id: "examination"
|
||||
name: "Examination"
|
||||
- id: "analysis"
|
||||
name: "Analysis"
|
||||
- id: "reporting"
|
||||
name: "Reporting"
|
||||
Reference in New Issue
Block a user