Packet captures are unable to be saved to /home/admin/transfers on the SEDR appliance

Products

• Endpoint Detection and Response

Issue/Introduction

When using the 'tcpdump' command, you may try to save the capture file to the /home/admin/transfers folder to be downloaded through the SEDR appliance web interface.

Cause

The 'tcpdump' command was previously locked down to only the /home/admin folder.

Resolution

Starting with SEDR 4.2, you can save packet captures to the /home/admin/transfers folder. Once the capture is saved, you can download the file from the bottom of the Global Settings page at the File Transfer option.

Note: This only works on the Manager or All in One role, if you are performing a packet capture on a Scanner only role, you will need to use SCP to copy the file to a local computer with the 'getpcap' command.