Skip to content

Readme.md

Latest commit

 

History

History
38 lines (35 loc) · 2.54 KB

Readme.md

File metadata and controls

38 lines (35 loc) · 2.54 KB

Agent Build System

  • Causation Extractor

    • Runs at the creation of a new project
    • The causation extractor groups together events from an ECELd project based on timing and salient artifacts

  • Builder

    • The builder displays the relationships created by the causation extractor
    • Relationships can be selected and moved over to the dependencies table
    • The salient artifacts window allows users to add or remove salient artifacts, or change the color of salient artifacts
    • By default, salient artifacts are highlighted in red color
    • From the events in the dependencies table, the user can generate a script to be run by the runner

  • Runner

    • Execute scripts generated by the user in the Builder and works in conjuction with ECELd to validate observation dependencies.
    • Runner tab can be selected from the main window.
    • Only python files generated by the Builder will be loaded onto the Runner when clicking "Load Script" button.
    • Loaded Script will be displayed on the left side of the Runner GUI.
    • User can set the time out feature by typing it or clicking increasing/decreasing arrows in the box in the right corner. (Value is in seconds)
    • Right window in the Runner GUI will display actions executed by the script; the observations it checked for, the matches that the validator was able to validate, the stopping of a script, and any time outs that ocurred.
    • The "Stop" button on the lower right corner will interrupt the sript, and kill the process.
    • A new instance of a script after the user stops the current execution.

  • Packager

    • Allows user to import/export all the elements of ABS including VM's.
    • User can decide to include or exclude items from the packaged project by checking or unchecking the checking box.
    • User can decide to exlude or include VM's by checking or unchecking the checking box.
    • The packager retrieves the virtual machines recognized by VirtualBox
    • The packager will create a zip file with all included files at the specified directory

Installation and Setup

  • ABS can be installed in Kali Linux using the script install.sh
    • Running install.sh installs ABS in the user's home directory
    • The script creates a desktop shortcut for the user
    • The script creates a new script: abs-gui, that the user can run manually if they wish
  • The Packager can be ran on Windows as a standalone exe file
    • Located under Packager/dist

For more information about ABS refer to the Help menu in the Main Window GUI.