Listen to this Post
Introduction:
Microsoft Defender XDR provides a powerful process tree for visualizing attack chains, but analysts often need to extract and manipulate this data externally. The XDR Story Parser is an open-source browser-based tool that solves this, enabling deep, offline analysis of forensic data without exposing sensitive information to third-party services.
Learning Objectives:
- Learn to extract and redact sensitive data from Microsoft XDR process trees for secure external reporting.
- Master the techniques for exporting visual process tree screenshots and isolating specific process branches.
- Acquire the skills to automatically decode and extract all PowerShell scripts and command-lines from complex attack narratives.
You Should Know:
- Cloning and Hosting the XDR Story Parser Tool
The entire tool runs client-side, requiring no server. The first step is to clone the repository to your local machine or an internal web server.
`git clone https://github.com/glueckkanja/xdr-story-parser.git`
This command clones the entire tool’s repository from GitHub. Once cloned, you can navigate into the directory and host it using a simple Python HTTP server for local access. This ensures all sensitive process tree data is parsed entirely within your trusted environment, with zero data egress to external clouds. -
Loading a Process Tree JSON File for Analysis
The tool operates on the JSON data exported directly from the Microsoft Defender portal. The loading is handled entirely by the browser’s FileReader API.
// Example of the manual JSON structure expected by the tool (for reference):
{
<h2 style="color: yellow;">"": "Alert: Ransomware Activity",</h2>
<h2 style="color: yellow;">"Tree": {</h2>
<h2 style="color: yellow;">"ProcessId": "1234",</h2>
<h2 style="color: yellow;">"ImageFile": "cmd.exe",</h2>
<h2 style="color: yellow;">"CommandLine": "cmd.exe /c powershell -ep bypass -enc JABzAD0AJwB3AGkAbg...",</h2>
<h2 style="color: yellow;">"Children": [...]</h2>
}
<h2 style="color: yellow;">}After cloning and hosting the tool, simply open the `index.html` file in a modern browser. Use the “Open” button to load a JSON file you’ve exported from Microsoft Defender. The tool parses the file instantly in memory, rendering the interactive process tree without any network calls.
3. Redacting Sensitive Information from the Tree
Before sharing reports with broader audiences, redacting PII, internal IPs, and usernames is critical.
Within the loaded tool interface, locate the “Redact” feature. You can input custom regex patterns to match and automatically obscure sensitive data patterns like `(?:[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,})` for email addresses. The tool applies these patterns client-side, permanently altering the in-memory data for safe export, ensuring no sensitive data is leaked.
- Exporting the Process Tree as a PNG Screenshot
Creating a high-resolution visual is essential for including in incident reports or presentations.
After building the process tree visualization in the tool, click the “Export as PNG” button. The tool uses the `html2canvas` library to capture the current DOM state of the process tree and triggers a browser download of a high-fidelity PNG image. This allows you to easily document the entire attack chain or a zoomed-in subsection for evidence.
5. Extracting All PowerShell Commands and Scripts
Advanced attacks heavily obfuscate PowerShell commands within process trees. This feature automatically decodes and aggregates them.
Upon loading the JSON, the tool’s parser recursively traverses the entire process tree object. It identifies processes with powershell.exe, pwsh.exe, or common obfuscated command-line indicators. It extracts the full command-line argument and, for common encoding like Base64, automatically decodes it, presenting a clean, searchable list of all scripts used in the attack for further analysis.
6. Zooming and Isolating a Specific Process Branch
Complex trees can be overwhelming. Focusing on a specific malicious branch is key to efficient analysis.
Within the interactive visualization, simply click on any process node. The tool will immediately isolate the view to show only the parent and child processes related to the selected node, hiding all unrelated branches. This allows an analyst to focus exclusively on the execution chain of a payload, a persistence mechanism, or lateral movement activity.
- Validating the Integrity of the Offline Analysis Environment
Ensuring your local analysis environment is secure is paramount before handling live incident data.
` Check listening network connections to ensure the Python server is only bound locallynetstat -an | grep :8000
Expected output: tcp 0 0 127.0.0.1:8000 0.0.0.0: LISTEN
Disable outgoing HTTP/S traffic for the browser using OS-level firewall (Linux example)
sudo iptables -A OUTPUT -p tcp –dport 80 -j DROP
sudo iptables -A OUTPUT -p tcp –dport 443 -j DROP`
After starting the local Python HTTP server (python3 -m http.server 8000), verify it is only accessible via localhost. For an extreme air-gapped analysis, use OS firewall rules to block the browser from making any external network connections, guaranteeing that no tool dependencies can “phone home” and that your data remains completely contained.
What Undercode Say:
- The shift towards client-side, offline forensic tools is a direct response to escalating data privacy concerns and the need for air-gapped analysis in high-security environments.
- Open-source tooling that leverages modern browser capabilities is democratizing advanced threat hunting, moving it out of exclusive, expensive portals and into the hands of all analysts.
Our analysis indicates that the XDR Story Parser is more than a simple utility; it represents a broader industry trend. As EDR and XDR platforms generate increasingly complex and sensitive data, the ability to dissect that information offline becomes a critical operational capability. This tool empowers organizations to conduct deeper forensic investigations, create tailored reports for different audiences, and train junior analysts on real data without compromising security. It effectively breaks down the walls of the vendor portal, returning ownership and control of forensic data to the defender.
Prediction:
The capabilities demonstrated by the XDR Story Parser will soon become standard expectations within all major security platforms. We predict that within two years, native, one-click export features for offline and custom analysis will be integrated directly into Microsoft Defender, CrowdStrike Falcon, and SentinelOne. Furthermore, the core technology—client-side parsing and redaction—will be adopted for sharing IOCs and TTPs with industry partners, enabling more collaborative yet secure threat intelligence sharing without relying on centralized, and potentially targetable, portals. This will fundamentally change how cyber forensics are conducted across distributed enterprises.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Fabianbader Xdr – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
