Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Forensic Investigator
MD5 checksum (forensic-investigator_118.tgz) e0e5896470cdaa60755c87ac8077b6d1 MD5 checksum (forensic-investigator_117.tgz) 6b086028c6aa4b55387a6bb5622e439a MD5 checksum (forensic-investigator_114.tgz) a33c79ad1fea0517b3a95c27cc58124e MD5 checksum (forensic-investigator_113.tgz) aa7d534feacc1b347ef3127e5a2c8612 MD5 checksum (forensic-investigator_112.tgz) c5e0bd265c03c236beae6cde83bda2be MD5 checksum (forensic-investigator_109.tgz) 8e91a3a24d12247dd731baf8184483e8 MD5 checksum (forensic-investigator_108.tgz) 12e0e7be226f7c5801bced7174cd61aa MD5 checksum (forensic-investigator_107.tgz) 457870b28053ee1cbbe8ce70f7dd3013 MD5 checksum (forensic-investigator_105.tgz) 1ec90ab6f1cfc7c7ebba431c76255b22 MD5 checksum (forensic-investigator_104.tgz) 1ca9107239c6f04c22faa35d0bc1df6b MD5 checksum (forensic-investigator_103.tgz) 169dceac0a613c4029b683b662ea79fa MD5 checksum (forensic-investigator_101.tgz) 9a04e3e12d8f4937ece4ef202d48e1d9
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

Forensic Investigator

The TekDefense Forensic Investigator app is designed to be a Splunk toolkit for the first responder. Most tools do not need Internet access with the exception of a couple which use API calls. This Splunk app provides free tools for the forensic investigator which include, but are not limited to the following:
- VirusTotal Lookups
- Metascan Lookups
- Automater
- Base64 conversion
- XOR conversion
- HEX conversion
- and more... (check our documentation tab)

The Crew
- Tony Lee
- Ian Ahl
- Dennis Hanzlik
- Dan Dumond
- Dave Pany
- Matt Kemelhar
- Chris Lee
- Kyle Champlin

Automater Error:
- If you get the following error when running Automater: "External search command 'automater_wrapper"
- Please run the following command: chmod +x /opt/splunk/etc/apps/ForensicInvestigator/bin/
- This will be fixed in the next release. Thanks for your patience.

Note: To make the Investigator Chat work for regular users, they must have the admin_all_objects capability assigned. This can be accomplished by creating a role called chat_write and assign that role to the users. Finally assign the admin_all_objects capability to that newly created role.

Installation is very easy. Either download it within Splunk or from this Splunkbase page. Run setup (Help -> Configure App)

Currently the app contains no props or transforms (unless processing MIR output) so there is no risk of it modifying your data.

Stay tuned as we will be adding more tools as they are requested.

The current tools are:

URL/IP Domain Files En/Decoder Host
VT Lookup * WHOIS Lookup 1 * VT Lookup * Cyber Chef MAC OUI Lookup
Automater * WHOIS Lookup 2 * Automater * Base64 Converter Ping
Metascan IP * Metscan hash * Hex Converter Traceroute
URL Unshortener File Hasher XOR Converter SMB Share View
LinkExtractor * Hash Identifier NetBios Viewer
GeoIP Lookup ROT(n) Converter Port Scanner
DNS Resolver IP Converter Banner Grabber
URL Decoder
URL Parser

* Requires Internet access / API calls

The Toolbox menu contains:

  • ePO Connector <- Edit the bin\ to add ePO IP, port, username, and password
  • Investigator Chat Program
  • Bulk searching - wild
  • Bulk searching - specific field
  • Cheat sheets

The Help menu contains:

  • User Metrics
  • License Usage
  • Disk Usage
  • About
  • Send Feedback

Processing Redline and MIR files

  • Install Forensic Investigator app
  • default/eventtypes.bak -> default/eventtypes.conf
  • default/inputs.bak -> default/inputs.conf
  • default/indexes.bak -> default/indexes.conf
  • default/props.bak -> default/props.conf
  • Help -> Configure app, Make sure "MIR evidence dashboards" is checked
  • Restart Splunk

Setup Monitor directory

Install Samba

vim /etc/samba/smb.conf (add to the bottom of the file)

comment = Watch for incoming files
available = yes
writeable = yes
browseable = yes
public = yes
path = /monitor
guest ok = yes
read only = no
create mask = 0644
directory mask = 0755
force user = mirmonitor

Add the user

useradd mirmonitor
passwd mirmonitor
<enter password="">

smbpasswd –a mirmonitor
<enter password="">

Restart Samba

Service smbd restart
Service nmbd restart

Use the monitor directory

Drop Redline and MIR xml files in the following directory structure:





Release Notes

Version 1.1.8
Dec. 25, 2016

Version 1.1.8
- Added option to hide the MIR menus via the setup screen
- Added proxy support to setup screen
- Made vtLookup proxy aware
- Made vtLookup accept and use non-default API key
- Added CyberChef (En/Decoder -> CyberChef) - Big thanks to GCHQ for the awesome tool!
- Added ePO Connector to control McAfee ePolicy Orchestrator
- Requires editing bin\ and adding ePO IP, port, username, and password

Version 1.1.7
Sept. 5, 2016

Version 1.1.7
- Added Traceroute (Host -> Traceroute)
- Added Unshortener (URL/IP -> URL Unshortener)
- Added IP Converter (En/Decoder -> IP Converter)
- Added Processing of FireEye/Mandiant MIR output (Check details tab for instructions)
- System
- Network
- Processes
- Services
- Ports
- Tasks
- Prefetch
- ShimCache
- User account
- URL History
- Driver Modules
- Persistence
- File
- Eventlog

Version 1.1.4
May 8, 2016

New Features in v1.1.4
- Updated Investigator Chat 2.0!
- Added Ping tool (Host --> Ping)
- Added SMB Share Viewer (Host --> SMB Share Viewer)
- Added NetBIOS Viewer (Host --> NetBIOS Viewer)
- Added Port scanner (Host --> Port Scanner)
- Added Banner grabber (Host --> Banner grabber)
- Added Bulk searching of data using any field (Toolbox -> Bulk Search - Wild)
- Added Bulk searching of data using a specific field (Toolbox -> Bulk Search - Field)
- Added ASCII Table cheatsheet (Toolbox -> Cheat sheets -> ASCII Table)
- Added Ports and services cheatsheet (Toolbox -> Cheat sheets -> Ports and Services)
- Added subnetting cheatsheet (Toolbox -> Cheat sheets -> Subnetting)

Maintenance in v.1.1.4
- Renamed the xml files to increase simplicity

Version 1.1.3
April 14, 2016

Version 1.1.3
- Added a chat program for collaboration! It is a first stab, but give it a try (Help -> Chat Program)
- Added an additional whois lookup vendor - - ex:
- Added a link extractor to rip links out of a page (URL/IP -> Link Extractor)
- Added permalink information to VT lookup page
- Added disk usage monitor (Help -> Disk Monitor) (Uses REST API)
- Added license analysis page (Help -> License Usage) (*Need to have _internal logs on indexer and role based access)
- Fixed VT lookup script, incorrectly detecting MD5 hashes in URL - if (re.findall(r"(^[a-fA-F\d]{32})", sys.argv[1]))
- Fixed VT Lookup script, removed leading white spaces lstrip()
- Fixed bug in BulkWhois to provide state/province information

Version 1.1.2
April 12, 2016

Version 1.1.2
- First version of the app that is Splunk certified!
- Removed temporary csv file from package
- Edited python script to clean up temp files

Version 1.0.9
Feb. 17, 2016

v 1.0.9 - Conforming to app development/certification requirements
- app.conf now has a proper description
- Separated the file hasher stanzas from app.conf and placed them in filehasher.conf
- Created a README file in the install package
- removed local directory

Version 1.0.8
Nov. 23, 2015

- Removed hard-coded path from MAC OUI lookup (Thanks Darla!)
- Changed permissions on automater (Splunk upload bug?)
- Added Metascan IP (props to Josh)
- Added Metascan Hash (props to Josh)
- Added Automater Hash lookup
- Remove leading white spaces for metascan, hash-id, and other tools - they are now more human-proof

Version 1.0.7
Nov. 15, 2015

- raw_data properly parsed in whois tool
- Hasher now outputs hashes in caps
- Added File Hasher tool - based on file upload
- Temporarily removed Owner Search - it will be back

Version 1.0.5
Oct. 1, 2015

- Renamed category headings - parsed based on new tools and future plans
- Added whois lookup
- Added hashing tool - MD5, SHA1, SHA224, SHA256, SHA384, SHA512
- Added (Props to Zion3R at Blackploit)

Version 1.0.4
Sept. 25, 2015

- Updated MAC OUI Lookup to return multiple values based on partial match
- Added Automater!
- CSS updates
- Fixed word wrap for results with no white space
- Added drop shadow on dropdown menu
- Changed dropdown menu text color to teal

Version 1.0.3
Sept. 23, 2015

- ROT conversion is now case sensitive
- Added Hex panel to Base64
- Added GeoIP lookup for user selected IP
- Added MAC OUI lookup
- DNS lookup - local lookups

Version 1.0.1
Sept. 17, 2015

Version 1.0.1
- Introduce the apps and tools


Subscribe Share

Splunk Certification Program

Splunk's App Certification program uses a specific set of criteria to evaluate the level of quality, usability and security your app offers to its users. In addition, we evaluate the documentation and support you offer to your app's users.

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 50GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
© 2005-2018 Splunk Inc. All rights reserved.
Splunk®, Splunk>®, Listen to Your Data®, The Engine for Machine Data®, Hunk®, Splunk Cloud™, Splunk Light™, SPL™ and Splunk MINT™ are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners.