In an emergency, speed counts. So does the weight of your evidence. If you have to sort out access in the middle of an incident, you lose time you need. If you collect sloppily, you lose the chain of custody. The new DFIR offering in SecTepe.Core.CTI solves both. A SecTepe Collector handles the first acquisition. A two-part DFIR portal lets you upload without a login and keeps the analysis behind SSO.
SecTepe Collector: One Binary, One Hand-Picked Artifact Set
The SecTepe Collector is a Velociraptor offline collector with SecTepe branding. It is pinned to a hand-picked artifact set, inspired by Cyber Triage. The set covers:
- processes and network connections
- autoruns/persistence, services, and scheduled tasks
- users and DNS
- proof of what was run, plus event logs
- changes to the file system
An operator runs a single binary on the live endpoint. It packs everything into one container. It runs on Windows, Linux, and macOS.
Full Disk Image: On Purpose, Never Uploaded
When you need a full backup, the collector can create a bit-for-bit full disk image. It writes to an external drive or an SMB/Samba share. A GUI lets you pick the disk, and it can image more than one disk. The key point: this image is on purpose never uploaded. It stays with the customer. Only the small artifact collection goes up. That keeps data protection and bandwidth in check.
Two-Host Portal: Upload Without Login, Analysis With SSO
The DFIR portal is split across two hosts on purpose:
dfir-upload– a public uploader that needs no login. Each case has its own upload token. The operator on site needs no account.dfir– the analyst console, secured with SSO (Keycloak via oauth2-proxy). The portal container only listens on loopback. So the only way in is through the edge that checks your login.
Large collections go up as a chunked upload (8 MiB blocks) with a progress bar. The analyst's identity comes from X-Forwarded-Email. It is passed on as X-Actor into a tamper-evident chain of custody. X509-sealed evidence adds to it.
From Artifacts to Findings
In the console, all of this becomes a full picture of the case. You get:
- automatic scoring and a process tree
- a review workflow
- a case overview like Cyber Triage, with a host browser
- IOC matching across hosts, MISP enrichment, and a PDF case report
- Sophos log analysis
A pile of raw data turns into an incident story that holds up.
Part of the CTI Ecosystem
The collector works with the agentless sandbox. Suspect files from the endpoint go into detonation. The IOCs come together in MISP. Then the analyst triage ranks the result. That closes the loop from first acquisition to a rated finding.
Conclusion
SecTepe.Core.CTI gives you a simple collector binary, an upload with no login, and analysis behind SSO. That makes a professional first acquisition fast and keeps the evidence safe at the same time. Chain of custody and a PDF case report are included. This is DFIR without the usual friction inside the company.