I have just found this program for First Response analysis, and after reading about its features, it really surprised me to know that it is completely free!! However, I'm having quite a trouble in deploying the Agent part for network analysis. Have anyone faced this problem too?
The concrete errors obtained when trying to set the agent into "listen mode" are the following
First Response Agent 1.1.0.63 Running as [my_machine_name]
System.Exception Exception decrypting. Decryption failed. Key not valid for use in specified state.
at FirstResponse.Foundation.DataProtector.Decrypt(Byte[] cipherText, Byte[] entropy)
at FirstResponse.Foundation.DataProtector.Unprotect(Stream input, Byte[] entropy)
Object[] {creds.xml.protected, FirstResponseAgent}
Exception decrypting. Decryption failed. Key not valid for use in specified state.
System.Exception Exception decrypting. Decryption failed. Key not valid for use in specified state.
at FirstResponse.Foundation.DataProtector.Decrypt(Byte[] cipherText, Byte[] entropy)
at FirstResponse.Foundation.DataProtector.Unprotect(Stream input, Byte[] entropy)
at FirstResponse.Foundation.ProtectedStoreCredential.Decrypt(String path)
at FirstResponse.Foundation.ProtectedStoreCredential..ctor(String domain, String path)
at FirstResponse.FirstResponseAgentSession..ctor(FirstResponseAgentSettings settings)
System.Exception Exception decrypting. Decryption failed. Key not valid for use in specified state.
at FirstResponse.Foundation.DataProtector.Decrypt(Byte[] cipherText, Byte[] entropy)
at FirstResponse.Foundation.DataProtector.Unprotect(Stream input, Byte[] entropy)
at FirstResponse.Foundation.ProtectedStoreCredential.Decrypt(String path)
at FirstResponse.Foundation.ProtectedStoreCredential..ctor(String domain, String path)
at FirstResponse.FirstResponseAgentSession..ctor(FirstResponseAgentSettings settings)
at FirstResponse.FirstResponseAgentApp.RunDaemon(Arguments arguments)
at FirstResponse.FirstResponseAgentApp.Start(Arguments arguments)
at FirstResponse.FirstResponseAgentApp.Start(String[] args)
Any help would be fantastic!
Looking at the web site, the .Net framework is required. Beyond that, it would probably be better to contact the folks who wrote the tool…particularly if there *is* a problem with their product, so they can correct it.
Harlan
Hello iruiper,
If you haven't already found a solution for your issue, you may want to post it over at forums.mandiant.com. Our devs keep an eye on that board and are typically quick to respond to issues that arise with our software. I'd help you directly myself, but I suspect that they will be able to answer your question faster. )
– Matt