search

DFIRKuiper / Kuiper

Digital Forensics Investigation Platform
736 stars 110 forks source link
artifacts dfir digital-forensics incident-response parser security

readme

logo.png

Table of Contents

Premium Version


If you like Kuiper and want more, please contact us in CyberBomah, It is a total rebuild version with more features, including but not limited to:

Kuiper

Digital Investigation Platform

What is Kuiper?

Kuiper is a digital investigation platform that provides a capabilities for the investigation team and individuals to parse, search, visualize collected evidences (evidences could be collected by fast triage script like Hoarder). In additional, collaborate with other team members on the same platform by tagging artifacts and present it as a timeline, as well as setting rules for automating the detection. The main purpose of this project is to aid in streamlining digital investigation activities and allow advanced analytics capabilities with the ability to handle a large amounts of data.

diagram.png

Why Kuiper?

Today there are many tools used during the digital investigation process, though these tools help to identify the malicious activities and findings, as digital analysts there are some shortages that needs to be optimized:

With a large number of cases and a large number of team members, it becomes hard for team members collaboration, as well as events correlation and building rules to detect malicious activities. Kuiper solve these shortages.

How Kuiper Will Help Optimize the Investigation?

Use Cases

Examples

Create cases and upload artifacts create_cases

Investigate parsed artifacts in Kuiper create_cases

Kuiper Components

Components Overview

Kuiper use the following components:

Getting Started

Requirements

Notes

Install Docker Compose

sudo curl -L "https://github.com/docker/compose/releases/download/1.29.2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose sudo chmod +x /usr/local/bin/docker-compose sudo docker-compose -v


## Installation 

Starting from version 2.2.0, Kuiper run over dockers, there are 7 docker images:

- **Flask**: the main docker which host the web application (check [docker image](https://hub.docker.com/r/dfirkuiper/dfir_kuiper)).
- **Mongodb**: stores the cases and machines metadata.
- **Elasticsearch (es01)**: stores the parsed artifacts data.
- **Nginx**: reverse proxy for the flask container.
- **Celery**: artifacts parser component check [docker image](https://hub.docker.com/r/dfirkuiper/dfir_kuiper).
- **Redis**: queue for celery workers
- **NFS (Network File System)**: container that stores the shared files between Flask and Celery containers.

To run the docker use the following command:

```shell
sysctl -w vm.max_map_count=262144
git clone https://github.com/DFIRKuiper/Kuiper.git
cd Kuiper
docker-compose pull
docker-compose up -d

Issues

1 - Note: when you first run the dockers, Elasticsearch will fail to run and give the following error

ERROR: [1] bootstrap checks failed
[1]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

To solve the issue run the command

sysctl -w vm.max_map_count=262144

2- Note: if you faced the following issue

Creating network "kuiper_kuiper" with driver "bridge"
Creating kuiper_es01    ... done
Creating kuiper_mongodb ... done
Creating kuiper_redis   ... done
Creating kuiper_flask   ... error
Creating kuiper_nfs     ... done
Creating kuiper_celery  ... 

ERROR: for kuiper_flask  Cannot start service flask: error while mounting volume '/var/lib/docker/volumes/kuiper_kuiper_nfs/_data': failed to mount local volume: mount :/:/var/lib/docker/vCreating kuiper_celery  ... done

ERROR: for flask  Cannot start service flask: error while mounting volume '/var/lib/docker/volumes/kuiper_kuiper_nfs/_data': failed to mount local volume: mount :/:/var/lib/docker/volumes/kuiper_kuiper_nfs/_data, data: addr=172.30.250.10: permission denied
ERROR: Encountered errors while bringing up the project.

To solve the issue, run the command again 

docker-compose up -d

Troubleshooting

To check the dockers, run the command

docker-compose ps -a

It should show the results

     Name                   Command               State                         Ports                       
------------------------------------------------------------------------------------------------------------
kuiper_celery    /bin/sh -c cron && python  ...   Up                                                        
kuiper_es01      /bin/tini -- /usr/local/bi ...   Up      0.0.0.0:9200->9200/tcp,:::9200->9200/tcp, 9300/tcp
kuiper_flask     /bin/sh -c cron && gunicor ...   Up      0.0.0.0:5000->5000/tcp,:::5000->5000/tcp          
kuiper_mongodb   docker-entrypoint.sh /bin/ ...   Up      0.0.0.0:27017->27017/tcp,:::27017->27017/tcp      
kuiper_nfs       /usr/bin/nfsd.sh                 Up      0.0.0.0:2049->2049/tcp,:::2049->2049/tcp          
kuiper_nginx     /docker-entrypoint.sh ngin ...   Up      0.0.0.0:443->443/tcp,:::443->443/tcp, 80/tcp      
kuiper_redis     docker-entrypoint.sh /bin/ ...   Up      0.0.0.0:6379->6379/tcp,:::6379->6379/tcp

if anyone failed, check the logs for the service that failed

docker-compose logs -f --tail=100 <service>

Kuiper API

Kuiper has a limited feature API, check the repo DFIRKuiperAPI.

Issues Tracking and Contribution

We are happy to receive any issues, contribution, and ideas.

we appreciate sharing any parsers you develop, please send a pull request to be able to add it to the parsers list.

Licenses

Creators

Saleh Muhaysin, Twitter (@saleh_muhaysin),

Muteb Alqahtani, Twitter(@muteb_alqahtani)

Abdullah Alrasheed, Twitter(@abdullah_rush)