Open Source DFIR

Life of a GRR message Authored by Dan Aschwanden and Mikhail Bushkov, copied with permission. Introduction In this article a macro-level outline of how GRR Rapid Response (or GRR) messages are delivered via Fleetspeak as the communication conduit is provided. The details covered in this article will be valuable for scenarios where you need to debug or troubleshoot functionalities of GRR and/or Fleetspeak. Furthermore, the content in this article is also suitable as a first introduction to GRR and Fleetspeak. So whether you only get started or you are a seasoned practitioner we hope you will be able to take away something useful from this article. Fleetspeak does much of the heavy lifting for the GRR message exchange. Its design has some unique networking requirements which we already covered in a previous article . In this article we dive into the nature of the persistent connections that Fleetspeak clients (aka agents like GRR) use to communicate with the Fleetspeak server (aka fron...

  Running GRR everywhrr Authored by Dan Aschwanden and Mikhail Bushkov , copied with permission. Introduction GRR Rapid Response (or GRR) is an incident response framework focusing on remote live forensics. GRR consists of client and server parts which communicate with each other leveraging the Fleetspeak communication framework. In this blog post we investigate how GRR and Fleetspeak can be operated in a microservice based architecture. Real world deployments in complex enterprise networks often extend their requirements beyond GRR’s initial design of direct connectivity between the clients and the server. Choosing to leverage microservices and their related network architecture requirements introduces new communication layer challenges. We will cover how Fleetspeak serves as the communication conduit for GRR to exchange messages with the fleet of clients it investigates. We will also explore novel network architectures that are enabled by a set of recently implemented Fleetspea...