The ds4n6.py library provides multiple functions that can be used either standalone or in Jupyter (some of the functions are specifically designed to provide a friendly Jupyter output/visualization).
The library is divided in 3 broad categories:
Since most of the functions are designed (as of today) to aid in the post-processing / analysis of the output of traditional forensics tools (sleuthkit, plaso, etc.) the DS4N6 functions are aggregated by their corresponding tool.
Latest version:
Name | Description | |
---|---|---|
GENERIC ANALYSIS FUNCTIONS | ||
df_outlier_analysis(indf,sensitivity) | ||
exefile_analysis(exefs, thisexef_path) | ||
unique_files_folder_analysis(exefs, thisexed_path, exef_intg_max_occs, compop='==', recurse=False, prevdays=0, tsfield='m', verbose=False) | ||
exefs_analysis(exefs,thisexef_path) | ||
FILE SYSTEM TIMELINE | ||
read_fstl(fstlf, windows=False) | ||
fstl_size_top_n(fstl, n) | ||
read_fstls_filetypes(fstld, hosts, file_types, verbose=False) | ||
PLASO | ||
read_plaso_l2tcsv(plasof) | ||
read_plaso_json(plasof) | ||
KANSA | ||
read_kansa(kansad) | ||
VOLATILITY | ||
read_volatility(evd, prefix, ext) | ||
volatility_pslist_unfrequent_process_analysis(pslistdf, n) | ||
volatility_pslist_boot_time_anomaly_analysis(pslistdf, secs=30) | ||
volatility_processes_parent_analysis(pslistdf, critical_only=False) | ||
WINDOWS EVENT LOGS (evtx) | ||
read_evtx(evtxf,verbose=True) | ||
evtid_enrich(evtid) | ||
evtid_stats(evt) | ||
evtidsdf() | ||
evtidssr() | ||
evt_nonsysusers_stats(evts4624) | ||
evt_nonsysusers_access_stats(evts4624,firstdate,lastdate,freq) | ||
evt_nonsysusers_access_graph(evts4624,firstdate,lastdate) | ||
evt_nonsysusers_autoencoder_analysis(evts4624,firstdate,lastdate) |
Variable Name | Type | Description | |
---|---|---|---|
WINDOWS EVENT LOGS (evtx) | |||
critical_processes | Series | Critical Windows Processes (See SANS Hunt Evil Poster) | |
boot_start_processes | Series | Windows Processes Started at Boot time (See SANS Hunt Evil Poster) | |
process_parents | DataFrame | Well-known parent processes of critical Windows processes |
Name | Description | |
---|---|---|
FILE MANAGEMENT | ||
save_obj_pickle() | Save a python object to disk (dict, DataFrame, etc.) | |
load_obj_pickle() | Load a python object from disk (dict, DataFrame, etc.) |