Plaso 20200717 released

By

Plaso 20200717 released

The Plaso team is pleased to announce a new Plaso release, 20200717. This release is mainly a bug fix release.


The full list of cleanups, performance tweaks and bug fixes can be found in the release milestone. 


Where/how to get Plaso 20200717?

See Plaso's Users' Guide. The development team recommends using Docker to install Plaso without hassle. 


If Docker does not fit your needs there are installation instructions available for MacOS, Ubuntu and Fedora. 


If you run into problems take a look at the Installation Problems page in the Plaso documentation, to see if other people have seen the issue before. If nothing there helps, ask for help on the Open Source DFIR slack or open an issue on the tracker.

Popular posts from this blog

Incident Response in the Cloud

By
Many organizations have begun moving a majority of their services towards the cloud in recent years. As a result, attackers have shifted their focus towards the cloud. This has resulted in new techniques and methods specifically designed to compromise cloud infrastructure, like the recent SALTSTACK vulnerability that was widely exploited [1]. Therefore it is critical for these organizations to have an incident response team that understands the new risks attached to cloud and how cloud can make incident response easier or harder. 
In this blog post we will walk you through each phase you may encounter in traditional incident response and highlight the differences when adopting cloud computing. It is aimed towards both those who are new to incident response and cloud computing. We’ve included insights that will benefit organizations taking that step towards cloud who want to ensure they are prepared to respond efficiently to cloud incidents. 
Traditional Incident ResponseBefore jumping i…
Read more

Forensic Disk Copies in GCP & AWS

By Unknown
In a previous blog post, we briefly presented how libcloudforensics facilitates digital forensics investigation in the cloud. We recently added support for Amazon Web Services (AWS). In this blog post we will highlight solutions to the main challenges we faced while adding support for this cloud provider.Architecture and nomenclatureOne of the biggest differences between GCP and AWS lies in the way different cloud resources are structured. In GCP, a single account may work with multiple projects, with each project providing its own grouping of resources. These projects may in turn be grouped together within folders that all fall under a single organization. Identity and Access Management (IAM) policies can be applied at each of these levels: organization-wide, folder-wide, or project-wide. IAM policies can also be set individually for resources within a project.
In AWS, things are different. There are no “projects”. Instead, AWS recommends setting up multiple accounts for each team, an…
Read more

Introducing Libcloudforensics

By
Blog co-authored by Theo Giovanna and hacktobeer.
An increasing number of businesses are migrating their core IT environment to the cloud. Cloud computing offers these businesses a flexible and dynamic IT infrastructure, with on-demand availability of computing resources. Due to on-demand scaling cloud computing is also an interesting target for abuse. For people working in Digital Forensics and Incident Response (DFIR) this can mean you have to deal with a surge of security incidents at once [1].
Setting up an investigation-ready environment and responding to cloud incidents can be time-consuming. Already short-staffed DFIR teams need an efficient way to do this in order to keep up. This blog post introduces libcloudforensics, a library that is multi-cloud provider compatible and that provides a unified API that helps in reducing the time to set-up an investigation environment and automating part of responding to cloud compromises. Cloud Forensics For a more detailed explanation of …
Read more