Beginning with version 19, Griffeye Analyze DI Pro and Core will start using the new Griffeye Intelligence Database, or GID, to replace the legacy intelligence manager.
In this video, we’re going to discuss the changes that the GID brings to the Analyze DI interface, and how to use the Griffeye Intelligence Database system within your cases.
First off, let’s create a new case and take a look at the differences in the case creation process, which are very minor.
On the second page of the Import options, you’ll notice that the GID section has replaced the Database section. Analyze DI will now check imported files against all of your GIDs, if selected. Analyze DI will still check your files against any legacy databases you have connected.
On the Exclude page, you now have the ability to exclude files by GID source, in addition to any legacy databases you have connected. This can be done by selecting ‘Exclude files with hits in databases’ and selecting the GID source, or sources, you would like to exclude any file matches from.
These are the only two changes that version 19 brings to the case creation wizard at this time.
Now that our case has finished processing, let’s take a look at the changes to the Analyze DI interface related to the GID.
First off, you will notice that the GID has some new buttons in the ribbon on the Home tab. These buttons are used to manage, update, and migrate to your GID. You can also still access your legacy database manager from the ‘Manage Hash Databases’ button, but keep in mind your legacy databases are now in read-only mode and cannot be changed, with the exception of removing them.
Let’s select the GID management to see the GIDs you are currently connected to.
In this example, I have a local GID populated with hashes and intelligence, but because I’m using DI Pro, I am also connected to a remote GID in Sweden. How to set up and connect additional GIDs for collaboration will be discussed in a future video.
In the Case Data tab, we also see that we now have an additional GID button that will let users rescan their case against any GIDs that they are connected to. We will discuss this button’s functions in a few moments.
Moving to the bottom of the interface, you can also quickly check to see if your GID connections are OK by the GID Status infobar next to the Filters action button. Simply hover over ‘GID Status’ to see a list of GIDs and their connection state. A check mark indicates all your GIDs are in sync and ready to use.
In the Thumbnail view, users can quickly view GID and legacy database matches of individual files by hovering over the ‘Database Match’ icon in the thumbnail header icons. This will list all the databases and GIDs – including sources – that the file matched against.
GID matches also appear in the File Info panel, under the Summary tab, by scrolling all the way down to the GID section.
GID Matches columns are also now present in the grid view, each column representing an individual GID source.
Under Filters, on the Intelligence tab, there is a new quick filter for the GID, where users can filter to file matches based on individual GID sources. Data can also now be sorted by GID source matches as well.
Now let’s talk about the ‘Rescan Against GIDs’ button on the Case Data tab. This button is a two-function button: the top option will rescan your case against all available GIDs and categorize any matched files, but will not override any categorization work you may have already completed.
The bottom button allows you to match files against specific GID sources, overriding categorization for any matched files. It is important to note that using this option will overwrite any manual categorization work you may have already completed.
Click the bottom button, and a menu will appear allowing you to select the GID that you would like to overwrite your categorization from.
After you select a GID, a window will open asking which sources within that GID you would like to match against. This window requires that you read and check the box before performing a rescan. This is to ensure that you have acknowledged that your case categorization may be overwritten for matches in the GID source that you select.
Once you have completed your work and you are ready to update your GIDs with your categorization and intelligence data, select the ‘Update GIDs’ button from the ribbon.
This will allow you to select which GID you would like to update. Note that all of the hashes and intelligence will be placed in a hash source called ‘Case Work’ within the GID you update. Analyze DI will create this source for you when you perform your first GID update. Any future updates from other cases will also be assigned to the ‘Case Work’ source.
You can verify this source was created and updated by selecting the GID Manager and opening the GID you updated.
Thanks for watching. If you have any questions or comments, hit us up in the forums or shoot us an email to support@griffeye.com.
