Skip to content
This repository has been archived by the owner on Oct 20, 2023. It is now read-only.

Commit

Permalink
update Readme grammar (#121)
Browse files Browse the repository at this point in the history
Co-authored-by: James Bradford <[email protected]>
  • Loading branch information
arniebradfo and James Bradford authored Apr 7, 2023
1 parent 98e64a2 commit 7e433c4
Showing 1 changed file with 12 additions and 8 deletions.
20 changes: 12 additions & 8 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ Red Team C2 Log Visualization

![RedEye Screenshot](docs/images/RedEye-Hero-Screenshot.png)

RedEye is an open-source analytic tool developed by [CISA](https://www.cisa.gov/) and [DOE](https://www.energy.gov/)’s [Pacific Northwest National Laboratory](https://www.pnnl.gov/) to assist [Red Teams](https://en.wikipedia.org/wiki/Red_team) with visualizing and reporting command and control activities. This tool, released in October 2022 on GitHub, allows an operator to assess and display complex data, evaluate mitigation strategies, and enable effective decision making in response to a Red Team assessment. The tool parses logs, such as those from [Cobalt Strike](https://www.cobaltstrike.com/), and presents the data in an easily digestible format. The users can then tag and add comments to activities displayed within the tool. The operators can use the RedEye’s presentation mode to present findings and workflow to stakeholders.
RedEye is an open-source analytic tool developed by [CISA](https://www.cisa.gov/) and [DOE](https://www.energy.gov/)’s [Pacific Northwest National Laboratory](https://www.pnnl.gov/) to assist [Red Teams](https://en.wikipedia.org/wiki/Red_team) with visualizing and reporting command and control activities. This tool allows an operator to assess and display complex data, evaluate mitigation strategies, and enable effective decision making in response to a Red Team assessment. The tool parses logs, such as those from [Cobalt Strike](https://www.cobaltstrike.com/), and presents the data in an easily digestible format. The users can then tag and add comments to activities displayed within the tool. The operators can use the RedEye’s presentation mode to present findings and workflow to stakeholders.

RedEye can assist an operator to efficiently:
- Replay and demonstrate Red Team’s assessment activities as they occurred rather than manually pouring through thousands of lines of log text.
Expand All @@ -15,10 +15,10 @@ Red Team: [![Red Team](https://img.shields.io/endpoint?url=https://cloud.cypress
Blue Team: [![Blue Team](https://img.shields.io/endpoint?url=https://cloud.cypress.io/badge/simple/46ahz3&style=flat&logo=cypress)](https://cloud.cypress.io/projects/46ahz3/runs)

## [User Guide](<docs/User Guide.md>)
Follow the User Guide to learn about the RedEye feature set.
Follow along with the [User Guide](<docs/User Guide.md>) to learn about RedEye's feature set.

## Quick start
1. **Download** the latest RedEye binaries for [your OS](#platform-support) from the [Releases](https://github.com/cisagov/RedEye/releases) page.
1. **Download** the latest RedEye binaries for your OS[*](#platform-support) from the [Releases](https://github.com/cisagov/RedEye/releases) page.
2. **Pick a mode** and **Run the server**
- [ **Red Team mode**](#red-team) enables the full feature set: upload C2 logs, explore data, and create presentations. To start the server in Red Team mode, run the following in a terminal. _You must provide a password to run in RedTeam mode._
```
Expand All @@ -30,7 +30,7 @@ Follow the User Guide to learn about the RedEye feature set.
_**MacOS Issue** - When running RedEye for the first time, you may get a "not verified" error. You must go to "System Preferences" > "Security & Privacy" > "General" and click "Open Anyway." More info on the [apple support page](https://support.apple.com/guide/mac-help/open-a-mac-app-from-an-unidentified-developer-mh40616/)._

## Red Team & Blue Team Modes
RedEye has two modes that cover two stages of the Red Teaming process. [Red Team mode](#red-team) allows for import of C2 data, editing of imported data, and make comments and presentations. After curating and annotating the campaign data, the Red Team can export the campaign as a standalone .redeye file and [hand off to a Blue Team](#blue-team-presentation-handoff) for reporting and remediation. [Blue Team mode](#blue-team) runs RedEye in a simplified read-only mode for viewing curated data exported by a Red Team.
RedEye has two modes that cover two stages of the Red Teaming process. [Red Team mode](#red-team) allows importing C2 data, editing imported data, and making comments and presentations. After curating and annotating campaign data, Red Teams can export their campaign as a standalone `.redeye` file and [hand it off to a Blue Team](#blue-team-presentation-handoff) for reporting and remediation. [Blue Team mode](#blue-team) runs RedEye in a simplified read-only mode for viewing curated data exported by a Red Team.

_Note: Both Red and Blue Team modes can be started from the same RedEye application binary._

Expand Down Expand Up @@ -73,9 +73,13 @@ Folder/
```
`.redeye` files can also be uploaded in Blue Team mode via the "+ Add Campaign" dialog.

<!--
## RedEye Server Settings
RedEye runs as a server and can be setup to serve the UI on a network
***{instructions}***
RedEye runs as a server and can be setup to serve the UI on a network..
***{instructions}***
-->

### RedEye Server parameters
Type `./Redeye -h` to view the options
```
Expand All @@ -87,7 +91,7 @@ Type `./Redeye -h` to view the options
```

you can also configure the sever parameters in an `.env` file that sits next to the `RedEye` binary
***{is this true?}***
<!-- ***{is this true?}*** -->
```env
AUTHENTICATION_PASSWORD=937038570
AUTHENTICATION_SECRET=supertopsecretdonttellanyone
Expand All @@ -110,7 +114,7 @@ SERVER_PRODUCTION=false
- linux
## Development
### Setup
Install [Node.js](https://nodejs.org/en/) >= v16 ***{is this true? my v18 doesn't work?}***
Install [Node.js](https://nodejs.org/en/) >= v16
Install [yarn](https://yarnpkg.com/) globally via [npm](https://www.npmjs.com/package/yarn)
```
npm install -g yarn
Expand Down

0 comments on commit 7e433c4

Please sign in to comment.