Skip to content

2025-10-12

Latest

Choose a tag to compare

@vividDuck vividDuck released this 13 Oct 11:15
· 19 commits to main since this release

Updates in this version

The following are a list of developments since the last release and are currently pushed to the repo:

  • Official support for processing local collections or disk images, where multiple collections or images have been downloaded to a drive or network share. There is no new command for this, when you have already downloaded the collections/images you provide the --in-link with the word "local" and provide the local path -l as the folder where the collections are stored on disk and the --data-source-list, -d as the list of files to process, i.e. --in-link local -l x:\ -d "Collection-DC1.zip, Collection-FTP.zip, Veeam.vmdk. You can optionally provide the --out-link as "local", but you must combine that with the --update flag.
  • Timeline file for host information file - useful when only ingesting the timeline folder files into a SIEM
  • Timeline file for PowerShell history files, ConsoleHost_history.txt
  • Tests to confirm the WISKESS has been setup, and reporting any missing packages. Use the command setup -c to check if the setup completed completely.
  • Removed bloat-data in the message field of some timeline files, i.e. shellbags, hayabusa, and restructured others so the message field is easier to read in a CSV.
  • Fixed an issue in the network CSV in timeline, where multiple entries were shown for the same event
  • Fixed an issue with old-whip and GUI when using whipped, where some collections would not be extracted completely
  • artefact collection from disk images on Windows are now done in parallel

Full Changelog: v0.0.7-beta...v0.0.7

What's Changed

Full Changelog: v0.0.6...v0.0.7