Endpoint Analysis

Detection Tools: DeepBlueCLI, Velociraptor, Incident Response Cheat Sheets, OSquery

• DeepBlueCLI: https://github.com/sans-blue-team/DeepBlueCL – Event log analysis tool.
• Velociraptor: https://docs.velociraptor.app – Endpoint monitoring and response.
• Incident Response Cheat Sheets: https://www.sans.org/posters – SANS provides various IR cheat sheets (general resource).
• OSquery: https://osquery.io – Open-source operating system instrumentation framework.