Linux CatScale is a bash script that uses live of the land tools to collect extensive data from Linux based hosts. The data aims to help DFIR professionals triage and scope incidents. An Elk Stack instance also is configured to consume the output and assist the analysis process.
Usage
This scripts were built to automate as much as possible. We recommend running it from an external device/usb to avoid overwriting evidence. Just in case you need a full image in future.
Please run the collection script on suspected hosts with sudo rights. fsecure_incident-response_linux_collector_0.7.sh the only file you need to run the collection.
<div class="snippet-clipboard-content position-relative overflow-auto" data-snippet-clipboard-copy-content="user@suspecthost:$ chmod +x ./Cat-Scale.sh user@suspecthost:$ sudo ./Cat-Scale.sh “>
[email protected]:<dir>$ chmod +x ./Cat-Scale.sh
[email protected]:<dir>$ sudo ./Cat-Scale.sh