Markus Einarsson

icon location Linköping, Sweden icon location Blue teamer, defensive security, digital forensics, incident response, personal productivity, GTD, FIRE, paperless, metalhead.

Results 5 comments of Markus Einarsson

Support for more F-Secure alerts / log providers

Further research shows that the "F-Secure Ultralight SDK" provider and the FSecureUltralightSDK.evtx file seem to be present since F-Secure v14. For earlier F-Secure versions you have to rely on the...

Add low-memory-mode option to support larger input files

Feel free to remove the "Bug" label, since it would rather be an "Enhancement".

Offline collector split zip

Instead if relying on MDE to pull large triage files, you could let the Velociraptor offline collector upload the triage collection to Azure Blob Storage (or cloud storage in general)...

Offline collector split zip

Ahh, I see. Maybe [Selective Isolation Mode](https://learn.microsoft.com/en-us/defender-endpoint/isolation-exclusions) in MDE could be an option for this, but I guess some creativity might be needed.

Offline collector split zip

However, with compression enabled in the Offline Collector, I have so far never exceeded 3 GB (the file collection limit in MDE) for the resulting triage image. I just realized...