Tools

pbauhg, llc creations (in progress):

Analysis

How many systems did your Incident Response team examine in the last 6 months? How long did it take them to do that analysis? How complete was it?

For every system that is examined there can be large volumes of data to pour through to determine the state of a system, which takes time and focus of which Incident Response teams are often short.

pbaugh is working on tools to aid your team gain a full picture of a system rapidly, allowing them to dive into specific areas that require microscopic examination to fully understand a potential compromise.

Visualization

Being able to present the cohesive understandable picture of hostile attack is necessary. Especially in larger scale incidents when manually building a diagram becomes infeasible and can't represent the attacker actions over time. How else can you effectively communicate events to management, and help the team identify patterns in information?

pbauhg is working to be able to visualize important relationships, demonstrate connections over time, and provide continual updates to visualizations as more information becomes available.

Additional Tools for Incident Detection and Response

• Bro
• Suricata
• Snort
• Kismet
• Molock
• OSSEC
• Tripwire
• OSSIM
• ELK
  • ElasticSearch
  • LogStash
  • Kibana
• Splunk
• GRR
• OSQuery
• Apache Spot (Incubator)
• Facebook ThreatExchange
• Open Threat Exchange
• MISP
• CRITS
• Fido
• Maltego
• CaseFile
• Jupyter Notebook
• Redline

For more information, please email info@pbauhg.io