<img height="1" width="1" style="display:none;" alt="" src="https://px.ads.linkedin.com/collect/?pid=3026858&amp;fmt=gif">

2 min read

New in Binalyze AIR v1.7.50: Enriched Timeline with CSV import

Featured Image

Binalyze AIR v1.7.50 is now available. 

You can update directly from your product (shown below) or download it from the website here.

Binalyze AIR Release notesProduct release highlights:

  • Enriched timeline with CSV import
  • Microsoft Azure and Amazon  S3 Bucket evidence repositories
  • NSA web shell detection YARA rules

This blog post covers more details about the new feature set. You can go to the latest release notes here.

CSV import

After the first release of our Timeline feature, we started getting good feedback regarding the ease of use, simple UI/UX, and robust feature set. Along with that, we also received quality feedback for further enrichment of the timeline feature, so the first in line was – CSV import.

With the latest AIR release, we have enriched the Timeline capability with the CSV import feature that gives you the possibility to upload your own CSV file and start analyzing the uploaded data on your AIR Timeline. These CSV files can be collected from your cloud platform, firewall logs, or anywhere else. The source doesn’t play any role here. The important thing is that you can upload and start analyzing CSV files quickly and in a simple, collaborative way.

Before demonstrating the enrichment with the CSV file, let’s first create a new timeline.

Creating a timeline for your investigation

timeline Binalyze AIR

We will provide a unique name for this investigation and select a time zone so all events that AIR collects from these endpoints will align and normalize to the selected timezone. In the following step, we will choose a number of endpoints that we want to extract events from and click on “Create.”

By clicking create, you immediately assign a task to these endpoints to collect all relevant events and import them in a unified timeline. In around three to five minutes, the entire created timeline will appear in your AIR dashboard.

creating timeline for your digital forensics investigation

The great thing about the timeline feature is that it is collaborative so that multiple investigators can work on the same timeline simultaneously. Whenever they flag an event, it will be immediately visible to the other investigators. 

All flagged events will appear in the flag section, which proves as a handy feature in the reporting phase.

flagged events in investigations

Suppose you would like to enrich this timeline further by adding other endpoints. You can do that easily by clicking on the “Endpoint” button and selecting needed endpoints from the available list. 

With the latest AIR version,  we have extended this capability by adding support for custom CSV files. So now, we will enrich this timeline by using this new capability.

We will add a CSV file and import all the events from the file into the timeline in just four steps. 

csv import dfir

In the first stage, AIR shows a preview of the file format. So, when you click “Next,” you need to map between the CSV columns and the timeline event properties. In the third step, optionally, you can filter your data by importing all records, by date, or by the number of records. At the final stage, you will see a preview of how the events will look when you import them into your timeline. 

Once you click on “Import,” it will start processing the CSV file. 

As soon as you complete importing the file, you can simply click on “Go to timeline,” and it will bring you to the enriched timeline to start investigating.

Microsoft Azure and Amazon S3 Bucket evidence repositories

With this release, we are taking our first step toward cloud platforms and introducing two major evidence repositories. Now you can store collected evidence in your Azure Storage or Amazon S3 bucket accounts. If you select Azure or Amazon evidence repositories in the acquisition settings, evidence files will be uploaded to your cloud platform after the acquisition is completed.

NSA web shell detection YARA rules

With this release, AIR contains out-of-the-box YARA rules to flag web shells.

nsa yara rule

Download the new version here.

 

 

 

How to perform compromise assessment with 1 click?

Compromise assessment is an analysis of a network of endpoints or a single endpoint to uncover unknown security breaches, malware, and any sign of...

Read More

Microsoft Exchange Server Vulnerability Scanner (CVE-2021-42321)

UPDATE 15.11.2021.

Microsoft patches actively exploited Exchange, Excel zero-days (CVE-2021-42321). Please refer to their site for more details. 

...

Read More

The Tenth Step to Forensic Readiness: Legal review

When we plan our incident response strategies and forensic readiness steps, we strongly pay attention to digital evidence acquisition, storage,...

Read More