{=========----------[ Orion Squirrel Edition 0.4 ]-----------==========}
ORION
If you don't want to read the rambling in the rest of this document,
just get started by doing one or more of the following:
(if you're running live or have just installed)
* Open the web browser to http://localhost:8010/
* Open the Orion menu from the top left corner of the desktop
* Browse the /orion directory -- especially /orion/scripts/.
(if you're ready to install over a fresh ubuntu build)
* As root, run /orion/installers/INSTALL
Thanks for trying out it out, and be sure to give us your feedback:
orionlivecd@gmail.com http://orionlivecd.sourceforge.net/
{___________________ ---[ Licensing Stuff ]--- ________________________}
! Here's the thing: Orion is labor of love, and we're not doing it !
! for any sort of fame or fortune. However, there are a lot of !
! lawyers in the world and they _are_ in it for fame and fortune. !
! So, please be advised: !
Orion is a Combined Work of a original material and components under
various licenses. The original material included under /orion and
/home/alpha are referred to as the Orion Live CD Project.
Orion Live CD Project Copyright © 2010, 2011 John Jarocki, toastyguy, lithochasm
All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
1. Redistributions of source code must retain the above copyright notice,
this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.
3. Neither the name of the Orion Live CD Project nor the names of its
contributors may be used to endorse or promote products derived from
this software without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.
The Orion Live CD Project is an aggregate work that also includes many
other components -- each with their own licensing terms. The Copyright
and BSD license covering the original material in Orion does not invalidate
and terms of those other components
{___________________ ---[ End Licensing Stuff ]--- ____________________}
WHAT IS ORION?
Orion is a bootable LiveDVD for Incident Response, Intrusion Detection,
Malware Analysis, and Digital Forensics. There are many excellent
tools to perform these tasks individually, and there are even other
LiveCDs that provide focused frameworks. Orion is different because
it seeks to give structure to this process and automate as much as
possible.
Orion stands on the shoulders of giants by incorporating brilliant
tools created by many different experts in the field. Without those
folks, there would be no point to Orion. Typically an incident
response team will have seasoned analysts who are experts in a few
of these tools and familiar with many others. There are usually
also junior members of the incident response team or even conscripted
team members who don't do IR work frequently and are lost when
tasked with operating analysis tools. The effort we put into Orion
has gone into creating the "glue" for these proceses. For example,
the /orion/scripts/analyze-win-mem script runs the volatility tool
using conributed plugins that expert analysts would download and
install. The scripts provide the automation (even for experienced,
but sleep-deprived) incident response team members. And, the
analysts can read the scripts to understand the individual steps
and grow their expertise.
Finally, Orion also creates a framework for the parts of incident
response that deeply technical people typically hate, namely:
tracking, forms, and report writing. If you have any templates
or tips to share along these lines, we encourage you to contribute
the the Orion project.
Thanks and Enjoy,
--john
