Skip to content
Snippets Groups Projects
Commit e4fb1045 authored by Brian Carrier's avatar Brian Carrier
Browse files

added malware scanner doc template

parent ef61a987
No related branches found
No related tags found
No related merge requests found
/*! \page ct_malware_scanner_page Cyber Triage Malware Scanner Module
[TOC]
What Does It Do
========
The Cyber Triage Malware Scanner module will use the malware scanning infrastructure from Cyber Triage to identify if any Windows executables are malware. It will query an online service using the file's hash value to see if the file was already analyzed and allows you to upload files for analysis if they are new.
This module requires a commercial license from Cyber Triage.
For more information on obtaining a license, refer to [CyberTriage.com](https://cybertriage.com/autopsy-malware-module). The remainder of this page is about the use of the module once it is licensed.
Configuration
=======
Once you have a license, you must add it on the Options panel. Choose the 'Cyber Triage' tab and choose 'Add License'.
IMAGE
After you enter the license number that you should have received from your email, you will then need to review and agree to the license terms.
The options panel should now display information about the lookup limits. You can always refer back to here about what your limits are and when they reset.
IMAGE
Using the Module
======
Ingest Settings
------
For each data source, you select if you want files to be uploaded if they have not already been analyzed. By default, they are uploaded. You can choose to not upload them though.
IMAGE
Out of Scans
-------
If you go beyond your limits, you will get a dialog that not all files were analyzed. You can wait until your limits reset and then start ingest again with only the malware scanning module enabled. It will ignore the files that are already analyzed.
Seeing Results
------
Once ingest has completed, the files with malware will be listed in the Malware node in the tree.
IMAGE
*/
...@@ -58,6 +58,7 @@ The following topics are available here: ...@@ -58,6 +58,7 @@ The following topics are available here:
- \subpage ileapp_page - \subpage ileapp_page
- \subpage aleapp_page - \subpage aleapp_page
- \subpage yara_page - \subpage yara_page
- \subpage ct_malware_scanner_page
- Reviewing the Results - Reviewing the Results
- \subpage uilayout_page - \subpage uilayout_page
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment