How To Use FireEye RedLine For Incident Response P1 | TryHackMe RedLine

[@Saganis]

Did you see the comment about the Task6? Just finished Task 6 after fumbling around for 3 days... I think the instruction is not clear -- It should say that you have to apply the created IOC to the existing analysis in C:\Users\Administrator\Documents\Analysis

[@MotasemHamdan]

Yeah I heard that too. I will give it a try today. Thank you.

[@Saganis]

@@picardftw1313 Bring some time... This took me 60 Minutes to investigate (just idle loading time).

[@ian230187]

@@Saganis What was the condition you used? As in the IoC condition while creating the collector?

[@Saganis]

@@ian230187 You do not generate a collector. You simply open the existing analyse in the folder above. Then you create the IoC based on the Task6 details and you apply this IoC within the analyse as a IoC Search.

[@ian230187]

@@Saganis thanks a ton ....completed this an hour after i posted this

[@stevenchan4074]

Would like to ask how to overcome the error of unable to capture the information like - Events Logs, Driver Modules, Device Tree, Hooks, System Restore and System Information? From my initial finding, it appears "Directory does not exist" for the "Location for Acquisitions from this Session".

[@Maccanarchy]

Hey mate, mind if I ask what you do for work? Because you're extremely knowledgeable and create great videos and I'm just curious what specifically you do? If you'd rather not answer all good. Take care

[@MotasemHamdan]

Beside KZbin ? I just swim :)

[@Maccanarchy]

@@MotasemHamdan Hectic man, you're a fucking legend. Take care

[@pravinsingh4690]

will this redline works if machine is disconnected from the network? suppose in case ransomware attack, system got compromised and we have isolated the affected machine from the network. So after that can we run redline tool to collect the evidence becasue system is not live and its disconnected from the network

[@Saganis]

Hope you get well soon!

[@mochagawd]

Anybody else have a totally different Bios version? I get AMAZON - 1. System info says Amazon EC2 1.0, 10/16/2017. The Machine Name and Windows Product Number are the same and other questions have the correct answer

[@fotenks]

this whole lesson seems to be broken.

[@mochagawd]

@@fotenks I think the next day I started over and tried again and it worked?

[@othmanh]

مبدع يا باشا لاكن لو تشرح بالعربي أو تترجم الفيديو احسن لأن أكثر متابعينك عرب

[@embuscadeconhecimento1710]

esssa plataforma de ensino e jpgar dinheiro fora nem funciona direito se depender disso pra aumentar o numero de profissionais como dizem que esta faltando no mercado. ai que vai falta profissional mesmo.

[@Macj707]

CHEF CRISP WUZ HERE!

[@سيّن-ز1ف]

Hello, I have a simple work on this tool, is there a way to contact you

[@MotasemHamdan]

[e-mail]

[@سيّن-ز1ف]

@@MotasemHamdan ok ✅

[@سيّن-ز1ف]

@@MotasemHamdan