Turbinia — The Cyber Toolchain

Turbinia 20250131

Wed, 05 Feb 2025 23:01:15 GMT

Adds local docker compose debugging, Chrome credential parsing, ELF and Mach-O parsing • Adds local `docker compose` debugging support via a dedicated compose file configuration • Enables parsing and extracting saved Chrome credentials within Turbinia recipes • Adds ELF File Format Parsing capability for binary analysis • Adds Mach-O File Format Parsing capability for macOS binary analysis Full history on Cyber Toolchain: https://cybertoolchain.io/tools/turbinia

Turbinia 20240930

Wed, 02 Oct 2024 01:35:29 GMT

Adds `Task status v2` API for granular task state management and refreshed Yara rules at runtime. • Introduces `Task status v2` with improved task lifecycle management and logging updates. • Enables `Yara Analyser` jobs to refresh their rules dynamically at runtime. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/turbinia

Turbinia 20240820

Mon, 26 Aug 2024 18:41:15 GMT

Turbinia adds API endpoints and CLI commands for logs, evidence, output downloads, and new report views. • Adds API endpoint `download.output` to retrieve task artifacts • Adds `request.report` markdown functionality to the API server config • Adds `config.download` functionality to the API server config • Adds new commands to support the latest API endpoints (logs, evidence, download) • Adds request report view in the Web UI • Adds task report endpoint and corresponding UI changes • Updates OpenAPI spec to reflect new capabilities Full history on Cyber Toolchain: https://cybertoolchain.io/tools/turbinia

Turbinia 20240313

Wed, 13 Mar 2024 18:51:12 GMT

Turbinia adds LLM analyzer with VertexAI backend • `New Turbinia LLM analyzer`, `LLM lib interface` and `LLM lib implementation for VertexAI` • `Updated the turbinia-client API calls` to use the revised client library Full history on Cyber Toolchain: https://cybertoolchain.io/tools/turbinia

Turbinia 20231116

Thu, 16 Nov 2023 23:52:59 GMT

Adds evidence upload endpoints, statistics/workers API commands, VERSION_CHECK config, and PostgreSQL SCRAM cracking support • Added evidence upload and related endpoints to the API server and client • Implemented a TurbiniaEvidence object in Redis for internal state management • Generated OpenAPI code for evidence, workers, and statistics endpoints • Added statistics and workers commands to the CLI via the updated API client • Added PostgreSQL SCRAM password cracking support within existing task infrastructure • Introduced VERSION_CHECK configuration setting for release consistency enforcement Full history on Cyber Toolchain: https://cybertoolchain.io/tools/turbinia

Turbinia 20230726

Wed, 26 Jul 2023 14:57:48 GMT

Turbinia adds SSH brute force analyzer task and `redis-tool` script for Redis key management. • Adds the `SSHBruteForceAnalysisTask` to detect potential SSH brute force attacks • Adds the `redis-tool` script to query, delete, dump, and restore keys in Redis • Adds evidence size and name fields to the Turbinia API responses Full history on Cyber Toolchain: https://cybertoolchain.io/tools/turbinia

Turbinia 20230214

Wed, 15 Feb 2023 01:52:56 GMT

Turbinia 20230214 adds APFS and LUKS support, a Web UI V2 with task output export, and an API CLI tool. • Adds APFS filesystem support for mounting and processing disk images. • Adds LUKS encryption support for unlocking encrypted disk images in Turbinia tasks. Breaking changes: • The `turbinia-api-client` Python package has been removed; users must now use the built-in `api` CLI subcommand or other client methods. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/turbinia

Turbinia 20221103

Thu, 03 Nov 2022 22:35:55 GMT

Adds containerd evidence support, YARA min-score configuration, and CLI flag generation from evidence attributes • Adds `containerd` as a new enumeration method and evidence type with corresponding mounting support • Adds ability to generate command line flags directly from evidence attributes • Adds pre-validation of YARA rules and configurable minimum score via the new Yara Task • Expands Postgres compromise rule coverage to include Yugabyte databases Full history on Cyber Toolchain: https://cybertoolchain.io/tools/turbinia

Turbinia 20220919

Tue, 20 Sep 2022 01:50:05 GMT

Turbinia adds Web UI V1, API Server, ExpertWitness disk support, Yescrypt cracking, and optimized partition filtering. • `turbinia` now ships with a Web UI V1 and related containers/deployment scripts for visualizing jobs. • A new `Turbinia API Server` docker container is provided to expose endpoints programmatically. • Supports `ExpertWitnessFormat` disk images as a new input type for evidence processing. • The default `Filter/Optimize Partitions` process is now applied automatically to reduce workload. • A new Yara scanner replaces text matching analysis Tasks with new rules and analysis capabilities. • Added support for `Yescrypt` password hashing format in domain controller credential extraction jobs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/turbinia

Turbinia 20220701

Fri, 01 Jul 2022 22:23:53 GMT

Turbinia 20220701 adds PGSQL account analyser, Loki-based Yara integration, and dfDewey deployment scripts. • Adds `New PGSQL account analyser` for querying PostgreSQL accounts. • Enables `custom Yara rules` via integration with the Loki analyzer (increasing max file size to enable Kinsing detection). • Adds deployment scripts for dfDewey datastores. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/turbinia

Turbinia 20220216

Wed, 16 Feb 2022 22:30:54 GMT

Adds `-g` group status query to turbiniactl and implicit recipe loading in PyPI package • `turbiniactl status` gains `-g ` flag to bulk query request status for multiple evidence processing jobs • Recipe files are now loaded implicitly from the PyPI package, removing the need to set `RECIPE_FILE_DIR` or provide a full path Full history on Cyber Toolchain: https://cybertoolchain.io/tools/turbinia

Turbinia 20220113

Fri, 14 Jan 2022 00:43:46 GMT

Turbinia 20220113 adds bulk evidence processing, new TimelineJob, quick triage recipes, and GKE infrastructure management. • Adds support for making bulk requests to process multiple Evidence objects of the same type with a single `turbiniactl` command • Introduces `FileSystemTimelineJob` for creating timelines using `dfimagetools` • Provides new quick triage recipes for MacOS/Linux and updated Windows recipe • Adds a new script for managing GKE Turbinia infrastructure Full history on Cyber Toolchain: https://cybertoolchain.io/tools/turbinia