sroberts

# For a 1-1 transform, so we create one location entity based
# on the geolocation data.
trx.addEntity("maltego.Location", "New York, NY")

# This can also be placed in a loop and will result in multiple entities.
locations = ["New York", "Washington DC", "San Francisco"]
for location in locations:
  trx.addEntity("maltego.Location", location)

sroberts

# Create a Maltego Transform Exception
trx.addException("We're out of gummy bears!!! Abort.")
 
# ThrowExceptions returns the errored transform.
trx.throwExceptions()

sroberts

# Import MaltegoTransform-Python library
# from MaltegoTransform import MaltegoEntity
from MaltegoTransform import MaltegoTransform

sroberts

# This returns the transform as an XML representation that Maltego
# uses to update the graph.
trx.returnOutput()

sroberts

# Set up your Transform object. This is the basis for returning results.
trx = MaltegoTransform()

sroberts

• Hubot
• Hubot VTR Scripts & Hubot VTR Rhodey
• ChatOps at GitHub - @jnewland
• The Programming Butler: Hubot Scripts Explained
• Code School: Learn CoffeeScript
• Presentation: Using Robots to Fight Bad Guys - @sroberts

sroberts

Volatility Learning Resources

• Volatility - An advanced memory forensics framework
• Introduction to Volatility
• Volatility | Linux Forensics

Learning Exercises & Examples

• Honeynet | Challenge 7 Forensic Analysis of a Compromised Server
• Google Code | SampleMemoryImages

sroberts

Keybase proof

I hereby claim:

• I am sroberts on github.
• I am sroberts (https://keybase.io/sroberts) on keybase.
• I have a public key ASBN2JRFuuB8vzXzq06VSCrmaXjHU9q0LR4K6aM6UUujkgo

To claim this, I am signing this object:

sroberts

Here is an overview of my past (and sometimes upcoming) speaking opportunities.

2017

• Mind The Sec: TBD
• SANS DFIR Summit: Japanese Manufacturing, Killer Robots, & Effective Incident Handling

2016

• SANS Leadership Summit: Crisis Communication for Incident Response
• ArchC0n: Chasing Shiny Objects: InfoSec budget decisions in a hype driven world
• SANS DFIR Summit: Responding @ Scale - osquery for Mass Incident Detection &amp Response (Slides)

sroberts

Keybase proof

I hereby claim:

• I am sroberts on github.
• I am sroberts (https://keybase.io/sroberts) on keybase.
• I have a public key ASCkaqzoKIRjKiuUTpAnkRKZtNSZ2G-7D7VMh5w8QlVi2wo

To claim this, I am signing this object: