2016-10-24 04:33 PM
Is there a way to export files (attachments) from recreated events that doesn't involve having to download the attachments? We're looking for a way to extract reconstructed files from sessions and have them emailed to an address we can access on our dirty network for analysis. Is there any way to do this via scripts or NwConsole? Any information or suggestions would be welcome. #netwitness packets #download file #malware_analysis #malware #file export #email transport
2016-10-25 11:19 PM
You could likely write a python script which extracts files from identified sessions using the REST API.