Mandiant Redline 1.14

Наверное почти все используют Антивирусы в своей системе

New Features:
View in HX Button
There are now buttons in the Redline user interface that you use to view information that is an HX Series appliance. Thet are the View in HX buttons. Click these buttons to view details about alerts or indicators.
Support for URL Monitor Agents Events
A CSV export file or URL monitor agents events now displays in the Summary column. The Summary column is located in the Timeline Configuration area.
Parent Process Tab
A new Parent Process tab has been added to the UI when a process has a parent process ID associated with it. It provides additional information about the process: information about the process you selected to view and information about the user of the process.
File Tab
A new File tab as been added to the UI for the following types of agent event audits: File Write, Image Load, Process Lifecycle and URL Monitor. The File tab appears in the Selected Item Details pane.
Filtering Empty Parent PIDs in Image Loading Events
Support for Process Agents Events
Timeline Configuration Tab
Parent Identification Number
Fixed issues:
An agent triage now includes the event start time and MD5 information for each process life-cycle event.
The Show Details link appears in every row in the Tags and Comments area. Additionally, clicking the link now refreshes the information in that row.
The erroneous message Operation failed. This command is currently busy when the system is fetching an alert. The Busy state handling for the command message appears instead.
An Alert column now appears in the Tags and Comments pane.
Alert events are now displayed only once in DNS look-up events. Previously, the same alert event was displaced twice.
You can now sort the Alert column
A column called Summary has been added to the exported exploits events CSV file.
Using the Copy with Headers option in the Timeline Configuration area to copy rows no longer generates an error message.
Process names now are displayed in the Summary column in the Timeline Configuration pane when you select the Process Agent Event/Running/Generate check box
Each exploit detection event now is displayed as a hyperlink.
The Clear All Filters button in the Timeline Configuration pane has been renamed
The Buffer Collection Time Boundaries fields in the Agent Events area is now hidden if there are no processes to report.
Alert hyperlinks are now hidden if the event the link is pointing is in an out of boundaries state.
Minor errors in column headers have been corrected.

New Features:
Redline collectors will now automatically create a new analysis session file (*.mans) every time it runs. Thus making it easier for you to double-click to open and analyze your newly collected data.
As a result of this, the "Import from a Collector" option is now only needed for supporting legacy collected data and was removed from the "Getting Started" page. You can still find this option under the main menu.
Redline now identifies and hides all duplicate items from your collected data in all views except for Timeline. This makes it easier to review data collected from audits that generate many entries for the same forensic artifact such as file items found in common persistence locations. It also allows Redline to remove the restriction on importing multiple documents containing the same type of audit data (e.g. API Files and Raw Files) in the same analysis session.
Redline determines which items are duplicates by comparing the values for a set of fields that adequately describes an items uniqueness. However, there may be cases where an item may be incorrectly classified as a duplicate. In these cases the hidden items can be found on a tab within an item's details pane for review, and always visible within the timeline view.
All files related to an analysis session will now be saved directly alongside the analysis session (*.mans) file. This includes file acquisitions, IOC reports, and source audit files. All of these files were previously stored in the temp folder by default.
When "Analyzing Data From a Collector" you now have the option to move (default), or copy your collected data to reside along side your analysis session file as opposed to having it remain in its original location. You can modify this choice under the "Advanced" section of the "Start your Analysis Session" configuration wizard.
Resolved Issues:
When using the directory tree filters under the File System view, Redline will no longer incorrectly filter out files from your view when a directory that begins with the same literal string as the file(s) is unselected.
The "Analyze this Computer" and "Analyze a Saved Memory File" options should once again function correctly on Windows XP 64-bit machines.
Redline collectors once again run correctly when saved to a path location that contains spaces in it.

New Features:
The find panel available on all list views has been redesigned. It has been reorganized for improved space utilization, made to be always visible, and offers the ability to target a single column to apply your find and filter operations against.
The ability to filter your list views by tags and comments has been greatly enhanced. You now have the ability to filter your lists by multiple tags at once. You also have the ability to further refine your tag filters to include only items that either do or do not include a comment.
All Redline Collectors have been updated to allow collection against two additional operating systems: Windows 2012 and Windows 8. (Support for these operating systems is currently in beta status)
Mandiant Redline is now known as Redline, and most references in the application have been updated to reflect this.
Resolved Issues:
Redline is now compatible with Windows 8 and any other systems which have the .NET 4.5 framework installed.
Idle performance of Redline has been greatly improved, and will no longer consume large amounts of CPU when Redline is not actively analyzing data. This also greatly improves the usability on low powered computers and virtual machines.
Due to a number of issues, Redline no longer performs non-critical analysis in the background after your data has been imported. These analyses will once again be front loaded and performed during the initial import of data from your Redline Collector.
The "Analyze a Saved Memory File" and "Analyze this Computer" options will no longer fail with the following message "Redline was unsuccessful in creating audit results to analyze. Unable to determine where Memoryze stored the result documents".
Importing large MD5 whitelists will no longer cause Redline to fail with an out of memory exception.

New Features:
The find panel available on all list views has been redesigned. In addition to always being available and being reorganized for improved space utilization, it also now offers the ability to target a single column to apply your find and filter operations against.
The ability to filter your list views by tags and comments has been greatly enhanced. You now have the ability to filter your lists by multiple tags at once. You also have the ability to further refine your tag filters to include only items that either do or do not include a comment.
All Redline Collectors have been updated to allow collection against two additional operating systems: Windows 2012 and Windows 8. (Support for these Operating Systems is currently in Beta Status)
Resolved Issues:
Redline is now compatible with Windows 8 and any other systems which have install the .NET 4.5 framework.
Due to a number of issues, Redline no longer performs non-critical analyses in the background after your data has been imported. These analyses will once again be front loaded and performed during the initial import of data from your Redline Collector.