Install Kansa¶

Follow this journey on the SUSA workstation before enabling remoting or collecting endpoint data.

Source

Obtain Kansa from the approved repository and record the commit or release, download time and source.

Review

Inspect `kansa.ps1`, `modules.conf` and every selected module before execution.

Boundary

Use a disposable Windows lab and avoid permanently weakening PowerShell execution controls.

Installation¶

Prerequisites¶

The following are required for this procedure:

a Windows analysis system
Windows PowerShell 5.1
local administrator access
an internet connection for downloading Kansa
PowerShell Remoting enabled for the Kansa framework demonstration

Note

Use Windows PowerShell 5.1, rather than PowerShell 7, for this procedure. Kansa was developed for Windows PowerShell and older Windows PowerShell environments.

Check the installed Windows PowerShell version:

$PSVersionTable.PSVersion

Example:

Major  Minor  Build  Revision
-----  -----  -----  --------
5      1      26100  8875

Create a Tools Directory¶

Open Windows PowerShell as Administrator.

Create a directory for Kansa:

New-Item -Path "C:\Tools" -ItemType Directory -Force

Move into the directory:

Set-Location "C:\Tools"

Download Kansa¶

Option A: Download with Git¶

When Git is installed, clone the repository:

git clone https://github.com/davehull/Kansa.git

Move into the Kansa directory:

Set-Location "C:\Tools\Kansa"

Record the exact repository revision used in your case notes:

git rev-parse HEAD

Retain this commit identifier with the Kansa command, collection time and output. The repository can change after this guide is published, so recording the revision makes the workflow reproducible.

Unblock the PowerShell Scripts¶

Files downloaded from the internet may contain a Mark of the Web and may be blocked by PowerShell.

From the Kansa directory, run:

Get-ChildItem -Path . -Filter *.ps1 -Recurse | Unblock-File

Confirm that the main script exists:

Test-Path ".\kansa.ps1"

Expected result:

True

Review the Execution Policy¶

Check the effective PowerShell execution policies:

Get-ExecutionPolicy -List

For this PowerShell session only, allow locally stored scripts to execute:

Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass

Enter Y when prompted to select options.

This change applies only to the current PowerShell process and is removed when the PowerShell window is closed.

Warning

Do not permanently weaken the system-wide execution policy solely to run Kansa. Use the narrowest scope permitted by organisational policy.

Version and trust checkpoint

Kansa contains community-contributed PowerShell. A repository URL is not a trust decision. Preserve the exact revision, review dependencies and test the selected collector with harmless data before relying on its output.

Installation checkpointA downloaded script is blocked on the lab workstation. What should you do?

Select the action that preserves provenance and control.