Tools · Workbench

Triage collection and timelines

Lessons on KAPE, Plaso, Chainsaw, and Hayabusa: collecting a Windows triage package, building a super timeline, and hunting event logs offline.

4 lessons
47 min of reading
4 topics

Start with lesson 1 All workbenches

The first hours of an investigation decide what evidence survives. These lessons collect the artifacts that matter into a hashed container, parse them on a separate workstation, and read events from many sources on one clock.

Collect from hosts named in the investigation and record who approved it. Analysis always runs on the copy.

KAPE

1 lesson

01KAPE: collect a triage package and parse it with modulesRun KAPE with the KapeTriage target to copy key Windows artifacts into a VHDX with a copy log, then run EZ Tools modules over the copy so analysis never touches the original host.12 min

Plaso

1 lesson

01Plaso: build a super timeline from a lab disk image and filter itUse log2timeline to parse a lab disk image into a Plaso storage file, check it with pinfo, and export a two-hour window with psort so one incident’s events can be read in order.13 min

Chainsaw

1 lesson

01Chainsaw: search and hunt Windows event logs from a triage copyPoint Chainsaw at EVTX files from a triage collection, run its built-in rules and Sigma rules with a field mapping, and search for specific event IDs to confirm what a detection claimed.11 min

Hayabusa

1 lesson

01Hayabusa: a detection timeline and logon summary from Windows logsRun Hayabusa over a triage folder of EVTX files to build a CSV timeline of rule hits at medium severity and above, then use logon-summary to see which accounts signed in and from where.11 min