Kansa
#Operations Management#Security Operations
A Live Response collection script for Incident Response that automates the collection of artifacts from various Unix-like operating systems.
A Modular Incident Response Framework in PowerShell
This is a modular incident response framework built in PowerShell. It utilizes PowerShell Remoting to execute user-contributed modules across various hosts within an enterprise. The framework is designed to gather data for incident response, conduct breach hunts, or establish an environmental baseline.
It is advisable to upgrade to
It is advisable to upgrade to PowerShell v3 or a later version to ensure optimal performance.
For More Information, Visit
http://trustedsignal.blogspot.com/search/label/Kansa
- http://www.powershellmagazine.com/2014/07/18/kansa-a-powershell-based-incident-response-framework/
To use Kansa, first download and unzip the project files. After that, unblock the .ps1 files by executing the command: ls -r *.ps1 | Unblock-File. Additionally, make sure to check and configure your execution policies as needed.
