Kansa¶
What Kansa does¶
Live response and endpoint triage
Kansa is a modular, PowerShell based incident response framework for Windows environments. It uses PowerShell Remoting to execute collection modules on one or more Windows systems and return the results to a central investigation workstation.
- Collect live state
Processes, connections and selected Windows artefacts from authorised endpoints. - Find persistence
Review evidence of persistence and other incident response indicators. - Hunt consistently
Run reviewed collectors across multiple systems and compare them with a baseline.
Kansa is primarily a live response and triage framework. It is not intended to replace forensic disk imaging, memory acquisition or full endpoint monitoring platforms.
Authorisation required
Only run Kansa against systems that you own or are authorised to examine. Kansa can remotely execute PowerShell code and collect information from target systems.
Choose your journey¶
Prepare PowerShell, obtain Kansa and review the execution boundary.
Complete when the source and version are recorded.Beginner · Windows workstation 02Prepare remoting and modulesTest the authorised boundary and identify exactly which collector will run.
Complete before any remote collection.Guided · Isolated Windows lab 03Collect and analyse processesRun the focused demonstration, inspect TSV output and interpret process context.
Complete when one lead is bounded and reviewable.Beginner · Local collection 04Collect from remote systemsUse an explicit target list and stage the workflow across authorised endpoints.
Continue only after the local workflow succeeds.Intermediate · Two endpoints 05Preserve and troubleshootRetain output, hashes and errors, then diagnose Kansa or WinRM failures.
Apply throughout every collection.Evidence handling 06Go hands onType commands in the browser simulation or complete the two endpoint Full Lab.
Complete when another analyst can review the result.Guided beginner · Two alternative routesRecommended beginner path
Complete journeys 1 to 3 in order, review evidence handling, then try the Interactive Lab. Start the Full Lab only after both authorised endpoints pass the remoting checks.
Where Kansa fits¶
Focused, repeatable Windows live response collection across one or many explicitly authorised endpoints.
PowerShell Remoting executes selected modules and writes per host results into timestamped output folders.
Results are live system observations. A compromised host or user contributed module can return incomplete or misleading data.
Kansa is particularly useful when an analyst needs the same focused question
answered across several Windows systems. It is not a disk imager, memory
acquisition tool or substitute for independent corroboration. Although Kansa
modules are conventionally collection focused and use Get- names, that
convention is not a technical safety boundary: review every script before use.
Evidence workflow¶
The timestamped directory, module configuration, target list and error log are part of the evidence context, not housekeeping. Preserve them with the returned rows so a reviewer can identify what ran, where it ran and which hosts failed.
Before you begin¶
Confirm the authorised endpoint list and start with one disposable test system.
Validate the narrowest authenticated remoting boundary and review every collector before execution.
Prepare controlled storage and retain the target list, module configuration, timestamps and errors.
Do not confuse reach with confidence
Running the same collector across many hosts can reveal useful differences, but it also increases the impact of a configuration mistake. Start with one disposable endpoint, then a small canary group. Never allow a missing target list or module configuration to broaden the collection unintentionally.