On a known Ubuntu system with Docker running I was receiving no collection for the Docker containers. I noticed under the execution section for Ubuntu, at Line 778 in Cat-Scale.sh, the following 2 lines were missing:

		echo " - Docker and Virtual Machine info..."
		get_docker_info

Addition of those lines resulted in a collection.

In a recent case, I used the script on Suse Linux Enterprise, and the lsof excluding gvfs caused an error. If I remember correctly, it didn't like the fact that excluded path didn't exist.

https://github.com/FSecureLABS/LinuxCatScale/blob/0dc50570b295fe424aa81de89b97703df0525415/Cat-Scale.sh#L231

I worked it around by removing the -e parameter. I wonder whether it should be kept, in which case an additional if clause could be added for better compatibility; or if it could just get stripped.

Upcoming PR to add the zypper package list in addition of yum/apt listing. I'll edit this issue once I get the commit on my forked repo.

In the edge case where you don't want to full filesystem timeline because of i/o restrictions, one would still need a peek into the content of /tmp.

As it's an edge case, there's no need to add it to the logstash configuration.

Hello,

On Linux, your script only collects the main routing table:

I would suggest to call ip rule and ip --details route show table all instead of only ip route to get more information.

Working on a case today and the script hang.. after a bit of investigation and we figured out it was the get_executables function which states:
find / -type f -perm -o+rx -print0 | xargs -0 sha1sum
The reason behind the hang was that the system had a network share (fuse.sshfs) that was mounted, yet the outgoing/incoming traffic due to the incident was moderated heavily.. so basically the mountpoint was broken.

To avoid that with any other situation similar we could do a quick fix of:
find / ! -fstype nfs,sshfs,fuse.sshfs -type f -perm -o+rx -print0 | xargs -0 sha1sum

Or I we could explore a more inclusive solution that makes sure the mount points are alive before running the find (or running it with parameters defining specific paths) if we really want ALL the bins from ALL the things