How to Collect System Logs within 5 minutes | Best Tool for Incident Response | Easy Log Collection

[@BlackPerl]

Hey All. Please let me know how useful this tool gonna be for your day to day life in Incident Response.. Also post all of your queries down here. I will be happy to help!! Enjoy IR Flash!!

[@BlackPerl]

It does have Hindi Subtitle as well, so for anyone who needs can turn it on!! 😊

[@anishdash2084]

Awesome work mate!! You are on Fire!

[@BlackPerl]

Thank you for your feedback!!

[@samvarun4181]

Here in 50secs of upload... Big fan of your work...Many thanks for sharing this will definitely try this out

[@BlackPerl]

Thanks Buddy. Really appreciate it.

[@futurebuddies5335]

Excellent work!! This gonna make my life easier from now on!! 😍😍

[@BlackPerl]

Happy to hear that!

[@parulkhedwal1352]

Nice Video Archan...Content Request: Can you make an exclusive video on MITRE please?

[@BlackPerl]

Hey, Thanks for the feedback and appreciate your suggestion. Sure, I will compile one for sure. Please stay tuned!

[@dipubabu2440]

Brother, Can't thank you enough for the tool! I have been watching your training, it's really good. Kudos !! if you could do some training on forensics it would be appreciated.

[@BlackPerl]

Hey Buddy. Thanks a lot for the feedback, really appreciate it. 😊 I have some episodes done for Windows and Memory Forensics. Please check the playlist, it might be useful. And there are lot more planned for coming up sessions for forensics, please stay tuned!! Link- kzbin.info/aero/PLjWEV7pmvSa50erciZUSnzvE7nK0FyvsH

[@dipubabu2440]

@@BlackPerl Appreciate it, keep rocking!!

[@zivakhan4875]

Can't Thank you enough for sharing this one.. Amazing...

[@BlackPerl]

You are welcome Ziva!!

[@VaibhavKrishna18]

Awesome Archan !! How about getting these event logs into ELK test instance for further analysis? In an automated way.

[@BlackPerl]

Yes Buddy. That will be more awesome!! You have a deployment ready for this? We can another episode on this

[@ParlonsCybersecurite]

Hello Archan I have tried to run the batch file from D:\ drive I faced permission issue ( Access denied ) , so I copied "IR-Dump" at the root of C and run the batch file from there , then it worked ! This said , I would like to say thank you for sharing this

[@BlackPerl]

Hey Buddy. Thanks for the feedback! M glad that you got it working! And yes, generally for Org machines, we tend to have only one drive and corporate policies don't allow multiple fragments for bitlocker security etc. So easiest way is, keep this set up in desktop and give admin permission while opening CMD!! 😊

[@jackjk5203]

Hi bro. Can you explain the each logs and it's usage for forensic investigation. Is there any automated way to find anomalies using the IR flash collect logs and data.

[@BlackPerl]

Hey, for usage of each logs in forensic investigation you can check out basic forensics guidelines. There are several usecases and hence requirements of several logs. You can check out my previous video of Event Log forensics- 1. kzbin.info/www/bejne/f6vKoWaDmLeil8k 2. kzbin.info/www/bejne/roHaomlmbaeDiqc They will give you the idea how event logs can be used for forensics case studies. For findings anomaly; currently no functionality on IR Flash, since I had developed this only for log collection purpose. So, you might want to send those logs in your SIEM tools and then run correlation rules on them to find anomalies. Hope this helps 😊

[@ronmac2934]

Excellent work man!! Anything similar you have your arsenal for Linux?

[@BlackPerl]

Yep, Spot on!! Will cover soon!

[@ronmac2934]

@@BlackPerl will be waiting.

[@nuszkat9953]

Excellent work. Thanks for sharing this with us. Recently I have started working in IR and learning about various artifacts that can be collected depending on the nature of the investigation. I have a question regarding the selection of artifacts this script collects, did you select these artifacts based your previous experience with DFIR investigations where these were found as most valuable or are these based on certain standard procedure guidelines for conducting IR investigations ?

[@BlackPerl]

Hey Buddy. Thanks for lot for your feedback! So yes, these are compiled from my personal exp. and these are the most useful logs in any investigation. Also, these logs will cover most of the compliances!!

[@ManojKumar-yt5ne]

Could you please guide how to develop your IR-Dump exe application?

[@BlackPerl]

Hey, it's a bash script that's all.

[@ManojKumar-yt5ne]

@@BlackPerl Ok, Got it. Thanks for your prompt response. can we make an exe software application to pull all endpoint logs and push them to the server? If you know something, please suggest me

[@BlackPerl]

@@ManojKumar-yt5ne Yes we can. Just need to write a wrapper and make it executable.

[@ManojKumar-yt5ne]

Sure, thanks a lot

[@shabeeb09]

Awesome tool

[@BlackPerl]

Thank you Buddy!! Feel free to utilize it and also feel free to add your ideas!!

[@cyberwarriorall6260]

Awesome Awesome Awesome

[@BlackPerl]

Thank you so Much!!

[@Nick-sn3bl]

A linux tool like this would be awesome!

[@BlackPerl]

Yes, it's getting built. Will be released shortly