The first part of this presentation presents a new paradigm for the Incident Response process called Rapid Enterprise Triaging (RETRI), where the primary objective is to isolate the infected network segment for analysis without disrupting its availability. Part two of this presentation will introduce a new Enterprise Incident Response tool that complements the RETRI paradigm. The tool is a free, possibly open source, agent-based tool that is deployed to the compromised segment to perform the traditional incident response tasks (detect, diagnose, collect evidence, mitigate, prevent and report back). The tool will be released at Blackhat 2009 / Defcon 2009 if all goes well.For now you get screen shots.

Related Links:
http://www.outerz0ne.org/
http://hackerconsortium.com
      .

Pulled, hope to have it back up in a few months.

Special thanks to Scott and Brandon Moulton for the AV work, and SkyDog for letting me rip the videos.