3 ms·
I am not aware of any incident reponse methodology or technique that would involve anything more than tabular data. Even things like maltego, very cool but have
by _8j50 4y ago
I am not aware of any incident reponse methodology or technique that would involve anything more than tabular data. Even things like maltego, very cool but haven't seen them used in IR just by intel people to organize stuff for themselves.
- insanitybit 4y agoA core component of IR is pivoting - going from "I have this info" to "that lets me grab some other info". Graphs are really good at pivoting.
- _8j50 4y agoSo are pivot tables in excel. If you show me a tool that can handle csvs (and excel is crap at huge csvs, timelineexlporer is great) and nice graph UI, I am all for it. The number one priority is not missing stuff so there is no way around having to collect all the right data, eliminate known noise and sift through the data to piece together a timeline.