Beagle is an incident response and digital forensics tool that transforms security logs and data into interactive graphs for analysis.
Beagle is an incident response and digital forensics tool which transforms security logs and data into graphs.
Beagle is designed for incident responders and digital forensics analysts to convert diverse security data sources such as Windows EVTX logs, SysMon logs, and FireEye HX triages into graph representations. These graphs facilitate deeper investigation and visualization of security incidents, enabling users to explore relationships and patterns within their data effectively.
Beagle requires familiarity with Python and graph concepts for effective use, especially when using the library interface. The web interface simplifies interaction but may require Docker for deployment. Users should ensure input data formats are supported and consult the detailed documentation for configuring graph exports to external databases.
Install via Docker by pulling the yampelo/beagle image from Docker Hub
Install the Python package using pip: pip install pybeagle
Configure the tool as needed following the documentation on ReadTheDocsfrom beagle.datasources import SysmonEVTX graph = SysmonEVTX("malicious.evtx").to_graph()
Load a SysMon EVTX log file and convert it directly into a NetworkX graph.
from beagle.datasources import SysmonEVTX, HXTriage, PCAP from beagle.backends import NetworkX nx = NetworkX.from_datasources(datasources=[SysmonEVTX("malicious.evtx"), HXTriage("alert.mans"), PCAP("traffic.pcap")]) G = nx.graph()
Generate a combined graph from multiple data sources including SysMon, FireEye HX triage, and PCAP files.
from beagle.datasources import SysmonEVTX from beagle.transformers import SysmonTransformer from beagle.backends import NetworkX datasource = SysmonEVTX("malicious.evtx") transformer = SysmonTransformer(datasource=datasource) nodes = transformer.run() backend = NetworkX(nodes=nodes) G = backend.graph()
Manually run each step: load data source, transform events into nodes, and build a graph backend.