Regimented Potential Incident Examination Report - Revision history

.FUF at 20:04, 13 September 2008

2008-09-13T20:04:06Z

Pdxsharkey at 23:27, 6 May 2007

2007-05-06T23:27:47Z

Pdxsharkey at 23:27, 6 May 2007

2007-05-06T23:27:24Z

Pdxsharkey at 23:25, 6 May 2007

2007-05-06T23:25:23Z

Pdxsharkey at 23:19, 6 May 2007

2007-05-06T23:19:00Z

Pdxsharkey: /* External Links */

2007-05-06T23:08:36Z

‎External Links

Pdxsharkey: /* External Links */

2007-05-06T23:07:31Z

‎External Links

Jessek at 12:29, 20 April 2007

2007-04-20T12:29:21Z

Jessek: Fixed GPL Link

2007-03-19T12:53:10Z

Fixed GPL Link

Jessek at 14:37, 6 March 2007

2007-03-06T14:37:08Z

@@ Line 3: / Line 3: @@
 The Regimented Potential Incident Examination Report ('''RPIER''' or '''RAPIER''') is script based [[Incident Response|incident response]] tool released under the [[:Category:GPL|GPL]] by [[Intel]]. It is a modular framework.
-RAPIER is a windows NT based information gathering framework. It was designed to streamline the acquisition of information off of systems in a large scale enterprise network. It was designed with a pretty simple to use GUI so that end-users could be walked through execution of the tool on a system.
+RAPIER is a [[Windows]] NT based information gathering framework. It was designed to streamline the acquisition of information off of systems in a large scale enterprise network. It was designed with a pretty simple to use GUI so that end-users could be walked through execution of the tool on a system.
 Contact: rapier.securitytool@gmail.com
 == Features ==
 * Modular Design - all information acquired is through individual modules
 * Fully configurable GUI
-* SHA1 verification checksums
+* [[SHA1]] verification checksums
 * Auto-update functionality
 * Results can be auto-zipped
@@ Line 22: / Line 23: @@
 === Information Acquired through RAPIER ===
-* complete list of running processes
-* locations of those processes on disk
+* Complete list of running processes
-* ports those processes are using
+* Locations of those processes on disk
 * Checksums for all running processes
-* Dump memory for all running processes
+* Memory dumps for all running processes
 * All DLLS currently loaded and their checksum
-* Capture last Modify/Access/Create times for designated areas
+* Last Modify/Access/Create times ([[MAC times]]) for designated areas
 * All files that are currently open
 * Net (start/share/user/file/session)
-* Output from nbtstat and netstat
+* Output from nbtstat and [[netstat]]
-* Document all open shares/exports on system
+* All open shares/exports on system
-* Capture current routing tables
+* Current routing tables
 * List of all network connections
 * Layer3 traffic samples
-* capture logged in users
+* Logged in users
 * System Startup Commands
-* MAC address
+* [[MAC address]]
 * List of installed services
 * Local account and policy information
 * Current patches installed on system
 * Current AV versions
-* Files with alternate data streams
+* Files with alternate data streams (ADS)
-* Discover files marked as hidden
+* Files marked as hidden
 * List of all installed software on system (known to registry)
-* Capture system logs
+* System logs
-* Capture of AV logs
+* AV logs
-* Copies of application caches (temporary internet files) – IE, FF, Opera
+* Copies of application caches (temporary internet files) – [[Internet Explorer|IE]], [[Mozilla Firefox|FF]], [[Opera]]
 * Export entire registry
 * Search/retrieve files based on search criteria.
 == See Also ==
@@ Line 61: / Line 60: @@
 == External Links ==
-* [http://code.google.com/p/rapier/ Official website]]
+* [http://code.google.com/p/rapier/ Official website]
-* [http://groups.google.com/group/rapier-development?hl=en Google Discussion Group]]
+* [http://groups.google.com/group/rapier-development?hl=en Google Discussion Group]
 * [http://www.first.org/conference/2006/program/rapier_-_a_1st_responders_info_collection_tool.html Presentation at FIRST Conference 2006]
 [[Category:Incident response tools]]

@@ Line 5: / Line 5: @@
 RAPIER is a windows NT based information gathering framework. It was designed to streamline the acquisition of information off of systems in a large scale enterprise network. It was designed with a pretty simple to use GUI so that end-users could be walked through execution of the tool on a system.
-*Contact*: rapier.securitytool@gmail.com
+Contact: rapier.securitytool@gmail.com
 == Features ==

← Older revision		Revision as of 23:27, 6 May 2007
Line 4:		Line 4:

	RAPIER is a windows NT based information gathering framework. It was designed to streamline the acquisition of information off of systems in a large scale enterprise network. It was designed with a pretty simple to use GUI so that end-users could be walked through execution of the tool on a system.		RAPIER is a windows NT based information gathering framework. It was designed to streamline the acquisition of information off of systems in a large scale enterprise network. It was designed with a pretty simple to use GUI so that end-users could be walked through execution of the tool on a system.
		+
		+	Contact: rapier.securitytool@gmail.com

	== Features ==		== Features ==

@@ Line 6: / Line 6: @@
 == Features ==
-* Modular Design
+* Modular Design - all information acquired is through individual modules
 * Fully configurable GUI
 * SHA1 verification checksums
@@ Line 18: / Line 18: @@
 * Configuration File approach
 * Process priority throttling

@@ Line 1: / Line 1: @@
 {{Expand}}
+== Description ==
 The Regimented Potential Incident Examination Report ('''RPIER''' or '''RAPIER''') is script based [[Incident Response|incident response]] tool released under the [[:Category:GPL|GPL]] by [[Intel]]. It is a modular framework.
 == See Also ==

← Older revision		Revision as of 12:29, 20 April 2007
Line 11:		Line 11:
	* [http://sourceforge.net/projects/rpier Official website]]		* [http://sourceforge.net/projects/rpier Official website]]
	* [http://www.first.org/conference/2006/program/rapier_-_a_1st_responders_info_collection_tool.html Presentation at FIRST Conference 2006]		* [http://www.first.org/conference/2006/program/rapier_-_a_1st_responders_info_collection_tool.html Presentation at FIRST Conference 2006]
		+
		+	[[Category:Incident response tools]]

← Older revision		Revision as of 14:37, 6 March 2007
Line 2:		Line 2:

	The Regimented Potential Incident Examination Report ('''RPIER''' or '''RAPIER''') is script based [[Incident Response\|incident response]] tool released under the [[GPL]] by [[Intel]]. It is a modular framework.		The Regimented Potential Incident Examination Report ('''RPIER''' or '''RAPIER''') is script based [[Incident Response\|incident response]] tool released under the [[GPL]] by [[Intel]]. It is a modular framework.
		+
		+	== See Also ==
		+
		+	[[List of Script Based Incident Response Tools]]

	== External Links ==		== External Links ==