Cyber Triage

3 Ways to Make Digital Investigations Faster with Automation Everyone — except for some consultants paid by the hour — wants to skip the tedious work associated with digital investigation. The good news is there are

Adding automation to your #DFIR investigations means you have less decisions to make. Get rid of the tedious work! Focus on the fun stuff!

Here are my three thoughts on the most effective ways to add automation and which tools do them.

What are yours?

www.cybertriage.com/blog/3-ways-...

New Cyber Triage release with:
* New UIs to give you an overview of the endpoint
* Hyabusa integration
* Baseline
* Public key encryption on collector
* LOTS more....

Blog and Download Link: www.cybertriage.com/blog/3-14-re...

EDRs miss activity! 😲😱.
You should not miss webinar tmrw! 😀

Markus and I will talk about why EDR alerts could be days after an attack started.

We'll talk about how to do endpoint triage to see what else happened beyond the alert!

Mar 27 @ 11 Eastern

register.gotowebinar.com/register/916...

Alert Triage vs Endpoint Triage: What SOCs Need to Know As we talk to corporate security teams about how they respond to incidents and EDR alerts, we find it useful to highlight the Endpoint Triage step in

For those in the #SOC: Alert Triage vs Endpoint Triage

Blog post that is part of our Endpoint Triage series.

Alert triage focuses on validating and prioritizing the EDR/SIEM alert.

Endpoint triage focuses on prioritizing the host. How bad is it?

www.cybertriage.com/blog/alert-t...

I'm doing a webinar TMRW on investigation tools for endpoint triage. Basic idea is how to get quick and accurate results after an alert. EDR data plays a role in that, but it's not enough.

Endpoint Triage should be in any security team's process.

attendee.gotowebinar.com/register/281...

3 places to automate #DFIR Endpoint Triage. Which do you do?

The 3 themes we focus on for #DFIR endpoint triage. What are yours?

Endpoint Triage: What you do after you validate the EDR alert to understand the impact.

#DFIR Webinar Thu @ 11.

register.gotowebinar.com/register/142...

3.13 Adds MemProcFS and Extends the S3 and Recorded Future Sandbox Integrations Our holiday gift this year is some frequently requested features that came out in the 3.13 release: MemProcFS to support Windows 10 and 11 images

Cyber Triage 3.13 is the holiday gift you’ve been waiting for:

Integrations that make you faster.

→ MemProcFS integration
→ Expanded S3 integration
→ Detailed sandbox report

Complete 3.13 release notes: www.cybertriage.com/blog/release...