TruxtonService.xml - Revision history

Sam at 08:58, 25 December 2020

2020-12-25T08:58:11Z

Sam at 19:22, 24 December 2020

2020-12-24T19:22:20Z

Sam: /* Truxton Service */

2020-06-30T15:37:56Z

Truxton Service

Sam: /* etl */

2020-06-30T15:24:13Z

etl

Sam: /* etl */

2020-06-30T15:23:55Z

etl

Admin: /* Configuration File */

2020-05-18T21:12:31Z

Configuration File

Admin at 20:49, 18 May 2020

2020-05-18T20:49:12Z

Admin: Created page with "This file contains the information for turning a machine into a Truxton Exploitation node. =Truxton Service= Checks once per minute to see if ETLs and Services are running."

2020-05-18T20:38:24Z

Created page with "This file contains the information for turning a machine into a Truxton Exploitation node. =Truxton Service= Checks once per minute to see if ETLs and Services are running."

New page

This file contains the information for turning a machine into a Truxton Exploitation node.

=Truxton Service=
Checks once per minute to see if ETLs and Services are running.

@@ Line 48: / Line 48: @@
 Notice the first comment in the file, it logs who created the configuration file and when.
-<syntaxhighlight lang="XML">
+<source lang="XML">
 <root>
    <truxton_options>
@@ Line 174: / Line 174: @@
    </truxton_options>
 </root>
-</syntaxhighlight>
+</source>

← Older revision		Revision as of 19:22, 24 December 2020
Line 1:		Line 1:
	This file contains the information for turning a machine into a Truxton Exploitation node.		This file contains the information for turning a machine into a Truxton Exploitation node.
		+	The Truxton Service is responsible for keeping the correct number of exploitation processes running.

	=Truxton Service=		=Truxton Service=

@@ Line 28: / Line 28: @@
 * <code>controllable</code> - This attribute tells the Truxton Service if the ETL was written using Truxton libraries. This allows the ETL to be cleanly stopped by the Truxton Service.
 * <code>instances</code> - This integer controls the number of simultaneous processes the service will keep running.
-* <code>ququq</code> - The name of the message queue that this ETL uses.
+* <code>queue</code> - The name of the message queue that this ETL uses.
 ===service===

@@ Line 26: / Line 26: @@
 the <code>exe</code> element describes how the ETL should run and what the name of the executable file is.
-* <code>controllable</code> - This attribute tells the Truxton Service if the ETL was written using Truxton libraries. This allows
+* <code>controllable</code> - This attribute tells the Truxton Service if the ETL was written using Truxton libraries. This allows the ETL to be cleanly stopped by the Truxton Service.
 ===service===

@@ Line 5: / Line 5: @@
 =Configuration File=
 <syntaxhighlight lang="XML">
 <root>

@@ Line 3: / Line 3: @@
 =Truxton Service=
 Checks once per minute to see if ETLs and Services are running.
 =Configuration File=

← Older revision		Revision as of 20:49, 18 May 2020
Line 3:		Line 3:
	=Truxton Service=		=Truxton Service=
	Checks once per minute to see if ETLs and Services are running.		Checks once per minute to see if ETLs and Services are running.
		+
		+	=Configuration File=
		+	<syntaxhighlight lang="XML">
		+	<root>
		+	<truxton_options>
		+	<!-- This Truxton service configuration file was created 2020-05-14 14:55:35 by TruxtonService.exe running as SYSTEM from the machine named DESKTOP-5NRI5PO (10.0.0.172). -->
		+	<service_configuration_version>1840023666788</service_configuration_version>
		+	<!-- There should only be one purger of expired media on your network -->
		+	<purger>yes</purger>
		+	<work_schedule>
		+	<!-- If this service is not employed, the service will run but no ETLs will be allowed to run -->
		+	<employed>yes</employed>
		+	<monday>
		+	<on_duty>0000-2359</on_duty>
		+	</monday>
		+	<tuesday>
		+	<on_duty>0000-2359</on_duty>
		+	</tuesday>
		+	<wednesday>
		+	<on_duty>0000-2359</on_duty>
		+	</wednesday>
		+	<thursday>
		+	<on_duty>0000-2359</on_duty>
		+	</thursday>
		+	<friday>
		+	<on_duty>0000-2359</on_duty>
		+	</friday>
		+	<saturday>
		+	<on_duty>0000-2359</on_duty>
		+	</saturday>
		+	<sunday>
		+	<on_duty>0000-2359</on_duty>
		+	</sunday>
		+	</work_schedule>
		+	<emptyqueuethresholdseconds>3600</emptyqueuethresholdseconds>
		+	<etls>
		+	<etl>
		+	<description>This consumes BOLOs and creates Alerts.</description>
		+	<exe controllable="yes" instances="1" queue="alert">Alert</exe>
		+	</etl>
		+	<etl>
		+	<description>This expands archive files.</description>
		+	<exe controllable="yes" instances="1" queue="archives">Archives</exe>
		+	</etl>
		+	<etl>
		+	<description>This carves free space for files.</description>
		+	<exe controllable="yes" instances="1" queue="carve">Carve</exe>
		+	<arguments>-carve_threads 0</arguments>
		+	</etl>
		+	<etl>
		+	<description>This generates video contact sheets, the 10x10 grid of images taken throughout the video.</description>
		+	<exe controllable="yes" instances="1" queue="contactsheet">ContactSheet</exe>
		+	</etl>
		+	<etl>
		+	<description>This parses MIME email files.</description>
		+	<exe controllable="yes" instances="1" queue="email">EMail</exe>
		+	</etl>
		+	<etl>
		+	<description>This is the main file expander service.</description>
		+	<exe controllable="yes" instances="4" queue="expand">Expand</exe>
		+	</etl>
		+	<etl>
		+	<description>This performs final processing after all files are present. It performs count queries and updates statistics.</description>
		+	<exe controllable="yes" instances="1" queue="finishedstage">Finished</exe>
		+	</etl>
		+	<etl>
		+	<description>This identifies file contents and routes accordingly.</description>
		+	<exe controllable="yes" instances="1" queue="identify">Identify</exe>
		+	</etl>
		+	<etl>
		+	<description>This is a loader as an ETL. It has the responsibility to expand files and load media.</description>
		+	<exe controllable="yes" instances="1" queue="load">Load</exe>
		+	<arguments>-lq load</arguments>
		+	</etl>
		+	<etl>
		+	<description>This coordinates the poly file expansion process.</description>
		+	<exe controllable="yes" instances="1" queue="poly">Poly</exe>
		+	</etl>
		+	<etl>
		+	<description>This finds the all of the pieces of multi-part archives and expands them.</description>
		+	<exe controllable="yes" instances="1" queue="pfe">PolyFileExpander</exe>
		+	</etl>
		+	<etl>
		+	<description>This exploits Windows registry files.</description>
		+	<exe controllable="yes" instances="1" queue="registry">Registry</exe>
		+	</etl>
		+	<etl>
		+	<description>This exports registry files to the local filesystem, spawns RegRipper.exe, grabs the result and makes it a child file of the registry file.</description>
		+	<exe controllable="yes" instances="1" queue="regripper">RegRipper</exe>
		+	</etl>
		+	<etl>
		+	<description>This spawns executables to expand files then kills them when done.</description>
		+	<exe controllable="yes" instances="1" queue="remoteexpand">RemoteFileExpander</exe>
		+	</etl>
		+	<etl>
		+	<description>This generates the reports.</description>
		+	<exe controllable="yes" instances="1" queue="report">Report</exe>
		+	</etl>
		+	<etl>
		+	<description>This keeps the SOLR service running.</description>
		+	<exe controllable="yes" instances="1" queue="solrcontentstage">SOLR</exe>
		+	</etl>
		+	<etl>
		+	<description>This sends files to SOLR for content indexing.</description>
		+	<exe controllable="yes" instances="1" queue="solrfile">SOLRFile</exe>
		+	</etl>
		+	<etl>
		+	<description>This reassembles fragments of carved files into the correct order for viewing.</description>
		+	<exe controllable="yes" instances="1" queue="stitch">Stitch</exe>
		+	</etl>
		+	<etl>
		+	<description>This extracts text from files.</description>
		+	<exe controllable="yes" instances="1" queue="tqueue">TextExtract</exe>
		+	</etl>
		+	<etl>
		+	<description>This generates small thumbnail images from larger images.</description>
		+	<exe controllable="yes" instances="2" queue="thumbnail">Thumbnail</exe>
		+	</etl>
		+	<etl>
		+	<description>This uses Yara to scan files for the rules you specify. Normally this is a malware scanner.</description>
		+	<exe controllable="yes" instances="1" queue="yara">Yara</exe>
		+	</etl>
		+	</etls>
		+	<services>{Solr 5 Server\|\|$TextIndexerData$Search/bin/solr.cmd\|start -p 8983 -m 5416m -a "-XX:-UsePerfData"\|$TextIndexerData$Search/bin/solr.cmd\|stop -p 8983\|java.exe\|jetty.port=8983},</services>
		+	<!-- The shutdownmachine boolean value tells Truxton if it should power down the server once all ETLs go idle -->
		+	<shutdownmachine>false</shutdownmachine>
		+	</truxton_options>
		+	</root>
		+	</syntaxhighlight>