Digital Forensics and Incident Response - Second Edition

Autopsy

A large number of tools that can ingest threat intelligence are available to incident response analysts. For example, disk forensics platforms discussed in Chapter 8, Analyzing System Memory, have the ability to ingest hashes from threat intelligence feeds to search for IOCs. In addition to commercial disk forensics tools, the Autopsy platform can conduct searches against a hash set. Navigating back to the export format in MISP, there is the ability to download a .csv file of the event indicators. For event 711, download the CSV file. Next, filter the data and select the hash values from the type column. This produces the following list:

From here, the hash values can be loaded into Autopsy:

1. First, in Autopsy, click on Tools and ...