# Cyber Triage: Digital Forensics Specialized For Rapid Incident Response

> Cyber Triage is automated Digital Forensics and Incident Response \(DFIR\) software that allows cybersecurity professionals like you to quickly answer intrusion questions related to malware, ransomware, and account takeover\.

Generated by Yoast SEO v28.7, this is an llms.txt file, meant for consumption by LLMs.

## Pages
- [Home \(4\.0 Release\)](https://www.cybertriage.com/)
- [Digital Forensics Data Collection](https://www.cybertriage.com/features/digital-forensics-data-collection/)
- [New About Page](https://www.cybertriage.com/about/)
- [Team](https://www.cybertriage.com/team/)
- [Collaborative Investigations](https://www.cybertriage.com/collaborative-investigations/)

## Posts
- [DFIR \+ AI: Making Tool Decisions in a GenAI World](https://www.cybertriage.com/blog/dfirai-making-tool-decisions-in-a-genai-world/)
- [How a Fortune 100's IR Team Accelerated Client Investigations](https://www.cybertriage.com/blog/how-a-fortune-100s-ir-team-accelerated-client-investigations/)
- [How to Let AI Access Your DFIR and SOC Investigation Data](https://www.cybertriage.com/ai/how-to-let-ai-access-your-dfir-and-soc-investigation-data/)
- [Cyber Triage 3\.17: Use AI to Enrich and Report Your DFIR Artifacts](https://www.cybertriage.com/blog/cyber-triage-3-17-use-cyber-triage-with-ai/)
- [AI \+ DFIR Primer: Agents and Scalability](https://www.cybertriage.com/ai/ai-dfir-primer-agents-and-scalability/)

## Integrations
- [Swimlane](https://www.cybertriage.com/integration/swimlane/)
- [The Sleuth Kit](https://www.cybertriage.com/integration/the-sleuth-kit/)
- [Velociraptor](https://www.cybertriage.com/integration/velociraptor/)
- [Volatility](https://www.cybertriage.com/integration/volatility/)
- [Yara](https://www.cybertriage.com/integration/yara/)

## Contributors
- [Mike Wilkinson](https://www.cybertriage.com/team/mike-wilkinson/)
- [Larissa Duzhansky](https://www.cybertriage.com/team/larissa-duzhansky/)
- [Alex Detmering](https://www.cybertriage.com/team/alex-detmering/)
- [Chris Ray](https://www.cybertriage.com/team/chris-ray/)
- [Dr\. Brian Carrier](https://www.cybertriage.com/contributor/dr-brian-carrier/)

## Videos
- [Cyber Triage 3\.13 Release Webinar](https://www.cybertriage.com/video/cyber-triage-3-13-release-webinar/)
- [Cyber Triage 3\.12 Release Webinar](https://www.cybertriage.com/video/cyber-triage-3-12-release-webinar/)
- [Demo Data Set Overview](https://www.cybertriage.com/video/demo-data-set-overview/)
- [Cyber Triage Lite – USB to Network Collections Video](https://www.cybertriage.com/video/cyber-triage-lite-usb-to-network-collections-video/): This video shows you how to collect data from a live\-running host and import it into Cyber Triage Lite over the network\.  The collection tool in this case is launched from a network drive or USB share\. 
- [How to Respond with Cyber Triage](https://www.cybertriage.com/video/how-to-respond-with-cyber-triage/)

## Versions
- [Standard Pro](https://www.cybertriage.com/version/standard-pro/)
- [Team](https://www.cybertriage.com/version/team/)
- [Standard](https://www.cybertriage.com/version/standard/)
- [Lite](https://www.cybertriage.com/version/lite/)

## Artifacts
- [Local Session Manager \- Event 24 \(Disconnect\)](https://www.cybertriage.com/artifact/terminalservices_localsessionmanager_log/terminalservices_localsessionmanager_operational_24/)
- [Windows Terminal Server \- Remote Connection Manager Log](https://www.cybertriage.com/artifact/terminalservices_remoteconnectionmanager_log/)
- [Remote Connection Manager \- Event 261](https://www.cybertriage.com/artifact/terminalservices_remoteconnectionmanager_log/terminalservices_remoteconnectionmanager_operational_261/)
- [Local Session Manager \- Event 21 \(Logon\)](https://www.cybertriage.com/artifact/terminalservices_localsessionmanager_log/terminalservices_localsessionmanager_operational_21/)
- [Windows Terminal Services \- Local Session Manager Log](https://www.cybertriage.com/artifact/terminalservices_localsessionmanager_log/)

## Glossary Terms
- [Digital Forensics \& Incident Response](https://www.cybertriage.com/glossary-term/digital-forensics-incident-response/): Was a computer used in a crime? Did someone break into it? Did it malfunction or fail? The process of Digital Forensics \& Incident Response or DFIR emerged when computer scientists needed to understand what happened with the machine in the past\. Digital forensics involves analyzing the data stored inside the computer and Incident Response is the strategy of the best way to handle any breach that’s been detected\. Together the processes formalized the best possible approaches to answering the questions of how and when someone accessed the data inside a computer\.
- [Timeline Analysis for Incident Response](https://www.cybertriage.com/glossary-term/timeline-analysis-for-incident-response/): When a forensics team is called to investigate, one of the most important techniques they can deploy is to create a timeline of the events\. The breach is often the result of several different failures or weaknesses and the timeline allows investigators to gather all of the evidence in a single chart\.

Collecting all of the details in one coherent data structure can improve analysis\. While some breaches have obvious causes, some can only be understood after all of the failures can be analyzed together\. Timelines make it easier to understand causality and the relationships between the many moving parts of a modern enterprise stack\.
- [What Are YARA Rules?](https://www.cybertriage.com/glossary-term/what-are-yara-rules/)
- [What is Behavioral Analysis and Signature Analysis?](https://www.cybertriage.com/glossary-term/what-is-behavioral-analysis-and-signature-analysis/): Forensic investigators look for patterns and this investigation often takes two forms that complement each other\. The first is a very focused and efficient search for the unique sequences of bytes found inside known malware\. Finding these attack signatures is fast and effective\. 

The second part is more general\. The patterns of events like API calls, or database queries offer a historical record of what happened in the computer\. Deconstructing this data can reveal how and when malicious behavior began and an attacker gained access\. This analysis is more complex and time consuming, but it can be more effective at detecting new or unknown attacks\. 

Deployed together, the approaches can speed detection, evidence collection and analysis\. 
- [Types of Security Incidents](https://www.cybertriage.com/glossary-term/types-of-security-incidents/): Digital forensic teams are called to investigate a wide range of incidents that range from active security breaches committed by aggressive outsider attackers to passive, unintentional leaks brought about by mistakes and misconfiguration\. 

## Categories
- [Blog](https://www.cybertriage.com/topics/blog/)
- [New Features](https://www.cybertriage.com/topics/blog/new-features/)
- [Training](https://www.cybertriage.com/topics/blog/training/)
- [Releases](https://www.cybertriage.com/topics/blog/releases/)
- [AI](https://www.cybertriage.com/topics/ai/)

## Tags
- [incident response](https://www.cybertriage.com/tag/incident-response/)
- [cyber triage](https://www.cybertriage.com/tag/cyber-triage/)
- [automated incident response](https://www.cybertriage.com/tag/automated-incident-response/)
- [endpoint investigation](https://www.cybertriage.com/tag/endpoint-investigation/)
- [OODA Loop](https://www.cybertriage.com/tag/ooda-loop/)

## Glossary Types
- [DFIR](https://www.cybertriage.com/glossary_type/dfir/)

## Optional
- [Sitemap index](https://www.cybertriage.com/sitemap_index.xml)