Cyber Triage
Automated endpoint forensics tool that collects artifacts and scores them for investigation.
Technical Architecture & Overview
Cyber Triage, from Sleuth Kit Labs, the makers of Autopsy, collects volatile and file system data from suspect endpoints and scores artifacts as bad, suspicious, good, or unknown using heuristics, 40+ malware scanning engines, and bad lists. It analyzes files with YARA rules and event logs with Hayabusa, and shows a timeline of threats. Deployment covers single-investigator desktop use through self-hosted team servers, with the Standard Pro license priced per year.
Targeted Technical Use Cases
Rapid investigation of a suspicious endpoint by a responder who needs collection and triage in one pass.
Evaluation & Trade-offs
Core Strengths
- +Collection and scoring in a single workflow.
- +Imports disk images, memory images, and KAPE output as well as live collections.
- +Timeline view plus HTML, Excel, and CybOX report output.
Trade-Offs & Limitations
- -Windows-centric; Linux hosts are covered only through imported UAC collections, and Linux disk images are not supported.
- -No free edition: the Standard Pro license costs $3,500 per year, with a 7-day evaluation.
Defensive Security Application
Structured endpoint investigations during intrusion response.
Frequently Asked Questions
What is Cyber Triage?→
Cyber Triage, from Sleuth Kit Labs, the makers of Autopsy, collects volatile and file system data from suspect endpoints and scores artifacts as bad, suspicious, good, or unknown using heuristics, 40+ malware scanning engines, and bad lists. It analyzes files with YARA rules and event logs with Hayabusa, and shows a timeline of threats. Deployment covers single-investigator desktop use through self-hosted team servers, with the Standard Pro license priced per year.
What is Cyber Triage used for?→
Rapid investigation of a suspicious endpoint by a responder who needs collection and triage in one pass.
What are the strengths of Cyber Triage?→
- +Collection and scoring in a single workflow.
- +Imports disk images, memory images, and KAPE output as well as live collections.
- +Timeline view plus HTML, Excel, and CybOX report output.
What are the limitations of Cyber Triage?→
- +Windows-centric; Linux hosts are covered only through imported UAC collections, and Linux disk images are not supported.
- +No free edition: the Standard Pro license costs $3,500 per year, with a 7-day evaluation.
How is Cyber Triage used defensively?→
Structured endpoint investigations during intrusion response.