First of all
============

* For feedback, discussions, bugreports, feature requests, etc. feel free to join our ProcDOT forum (https://groups.google.com/forum/#!forum/procdot)
  or drop us a line: team@cert.at or chrisu@procdot.com

* We have created a number of tutorial videos to get familiar with ProcDOT. We recommend watching them to get the most out of ProcDOT.

* Furthermore you will find a cheatsheet on our website which sums up the most important things of ProcDOT.

* There's a FAQ section on the website. In case of an issue please check them out.

* Follow our Twitter channel to be up to date to latest news on ProcDOT (https://twitter.com/ProcDOT).


Prerequisites
=============

ProcDOT depends on third party software and therefore needs the following software pre-installed to work properly:

* Graphviz-Suite
  Windows: Get the installer and run it.
           (http://www.graphviz.org/pub/graphviz/stable/windows/graphviz-2.28.0.msi)
  Linux:   Use package manager to install.

* Windump/Tcpdump
  Windows: Get the executable and put it in any location.
           (http://www.winpcap.org/windump/install/bin/windump_3_9_5/WinDump.exe)
  Linux:   Use package manager to install.
           Important: ProcDOT needs tcpdump to have executable permissions for everyone otherwise tcpdump won't be callable!


Important steps to follow
=========================

You need to adjust Procmon's configuration (actually for each Procmon installation you want to be compatible to ProcDOT) to match ProcDOT's needs.
Therefore, in Procmon ...
* disable (uncheck) "Show Resolved Network Addresses" (Options)
* adjust the displayed columns (Options > Select Columns ...)
  * to not show the "Sequence" column
  * to show the "Thread ID" column

Furthermore ProcDOT needs to know where its third party tools are located.
Hence, in ProcDOT ...
* choose your Windump/Tcpdump (windump.exe/tcpdump)) executable as fully qualified path (ProcDOT options)
* choose your Dot executable (dot.exe) as fully qualified path (ProcDOT options)


On Linux ...
============

... be sure to set the executable-flag for executables!


To use the provided plugins ...
===============================

... copy the folder "plugins" (included in the zip archive) beneath your ProcDOT executable.


Quickstart into ProcDOT
=======================

1) Select your logfiles (Sad but true, the specs for Procmon's native file-format (.PML) are not (publicly) available. Therefore you have to export your .PML file to .CSV which can be easily done via the "Save" menuitem in Procmon. Be sure to select "all events".)
2) Choose graphing mode (no paths, compressed)
3) Select the first relevant (malicious) process (launching process)
4) Click "Refresh"
