WhiteKernel

Mainly DFIR

[DFIR-IRIS @dfir_iris]

🚀 Introducing #DFIR_IRIS v2! 🎉 Our IR collaboration platform just got better:

✅ Group management, access control and LDAP
✅ Comments, MD editors & new reports formats
✅ New customers page and stats
✅ Improved integrations

And much more! https://t.co/VEcmZUWfcY

[ekt0 @ektoplasma_]

This is my first contribution to IRIS blog. It gives an overview about modules, and tips on the development. Finally, it describes how to use our new module generator "iris-skeleton-module" based on cookiecutter. I hope it will help future contributions!

[DFIR-IRIS @dfir_iris]

Do you want to know more about #DFIR_IRIS modules? We just published the first part of a walkthrough to develop new modules, made way easier thanks to the module generator iris-skeleton-module.

https://t.co/Va7R7iNLWx

#DFIR

[ekt0 @ektoplasma_]

Azure AD : PRT, PRT Cookie and Application Token https://t.co/KJATsn7LRp

cc @ottersecx

[CoRI&IN @cecyf_coriin]

Présentation de Solal Jacob sur TAP-IR https://t.co/7SyJodT9J8 #CoRIIN2022

[DFIR-IRIS @dfir_iris]

This week, we will attend to the French infosec conference @sstic held in Rennes! We will give a talk (in French) Wednesday about IRIS. Check the schedule, there are many interesting talks 🔥
https://t.co/Z9EEs25UmH

#SSTIC #DFIR

[DFIR-IRIS @dfir_iris]

The weekend starts with a new #DFIR_IRIS version ! 🎉

v1.4.3 brings updates and DB backups from the interface, IOCs and modification history in timeline events, custom icons for assets, UI/UX and speed improvements. And more !

https://t.co/iA6gzf0LDe

#dfir

[DFIR-IRIS @dfir_iris]

#DFIR_IRIS v1.4.0 is here ! 🎉
New great features introduced in this release: VT and MISP integrations, custom attributes for every case objects, hooks triggered on various events, dark theme, minimal timeline view and more.
Check it out ! https://t.co/sFTJx2ueJf
#dfir

[DFIR-IRIS @dfir_iris]

The first version of the Python Client for #DFIR_IRIS is here ! You can now integrate IRIS and interact with it more easily. Almost everything you can do from the GUI can be done through the client. Try it out and give us your feedback ! https://t.co/TsFIChNpmO #dfir

[Koen Van Impe ☕ @cudeso]

I published a set of Python scripts that I use to integrate @dfir_iris , @MISPProject and @TimesketchProj #DFIR #CSIRT https://t.co/dchrsM73bb

[DFIR-IRIS @dfir_iris]

#DFIR_IRIS v1.3.0 is out, with a bunch of new features ! New timeline visualisations, batch uploads of IOCs and assets, shared links of case objects, quick timeline export, and much more. Check it out ! https://t.co/PEfkzb3xNO

[Koen Van Impe ☕ @cudeso]

Short writeup on incident response case management, DFIR-IRIS (by @AirbusCyber / @White_Kernel ) and a bit of MISP ( @MISPProject ) #DFIR #CSIRT https://t.co/tlfUq0wzkI

[Sebastien Larinier @Sebdraven]

Hey you want a real opensource application to follow your cases in #DFIR

https://t.co/ehm4LR1IA5

The team behind it's a real team doing dfir on real cases ! So don't hesitate to use it !

Perhaps a collaboration with #yeti !

[ekt0 @ektoplasma_]

Today we are very proud to release IRIS: https://t.co/oalBbEG2XT. It is a collaborative platform designed for and by IR analysts. Developed and used by the @AirbusCyber CSIRT (special mention to the main dev, @White_Kernel). 1/4

[ekt0 @ektoplasma_]

New minor version of IRIS: 1.2.1 and the last one before the end of the year! \o/
Thanks @eric_capuano and @waggabat for your contributions :)
And thanks everyone for your feedback ✌️
https://t.co/5JcntetbS0

[WhiteKernel @White_Kernel]

@francescofaenzi @ektoplasma_ @AirbusCyber Exactly ! This evtx module is just an example, but basically modules allows to process evidences through IRIS to keep it all in one place. If you have a triage ingestion process, you can create a module to make IRIS aware of your process and then upload triage outputs on IRIS.

[WhiteKernel @White_Kernel]

@SwiftOnSecurity @ektoplasma_ @AirbusCyber We’ll do soon ☺️! In the meantime some videos are available here https://t.co/MY0DqKUVHc

[WhiteKernel @White_Kernel]

@cedricpernet @ektoplasma_ @AirbusCyber There are some videos of it here https://t.co/MY0DqKUVHc. We’ll update the readme with screenshots 👍

[WhiteKernel @White_Kernel]

@DAVNADS @ektoplasma_ @AirbusCyber 👋 We made some videos of it here https://t.co/MY0DqKUVHc. It gives a first overview of what it looks like.

[coldshell @coldshell]

Congratz! \o/ @miaouPlop