Learn from 4 IR experts on how they do Endpoint Triage. Apr 17. I'll MC and you'll hear from @keydet89.bsky.social (Huntress), Kai Thomsen (Dragos), @dfirmike.bsky.social (Sleuth Kit Labs) and Quinnlan Varcoe (Blueberry Security). See you there! register.gotowebinar.com/register/600...

For those in the #SOC: Alert Triage vs Endpoint Triage Blog post that is part of our Endpoint Triage series. Alert triage focuses on validating and prioritizing the EDR/SIEM alert. Endpoint triage focuses on prioritizing the host. How bad is it? www.cybertriage.com/blog/alert-t...

Anyone looking for a free open source forensic tool that can mount bitlockered disk images? If so check out the new release of Autopsy. www.autopsy.com/autopsy-4-22...

We're using the term "Information Artifacts" for high-level #DFIR concepts like "Processes" and "Inbound Logins". I think they are easier to train than low-level Prefetch, UserAssist etc. (i.e. Data Artifacts). Those map to an Info Artifact (Prefetch -> Process). www.cybertriage.com/blog/informa...

This is a fascinating interview from @campuscodi.risky.biz about the actual productive use of LLMs in combating insider threats. Well worth the listen for a conversation around AI without a bunch of marketing BS. risky.biz/RBTALKS5/

Cyber Triage 3.13 is the holiday gift you’ve been waiting for: Integrations that make you faster. → MemProcFS integration → Expanded S3 integration → Detailed sandbox report Complete 3.13 release notes: www.cybertriage.com/blog/release...