artifact-collector

Forensic artifact collection involves gathering files, memory dumps, Windows Event Logs, Mac Unified Logs, and PCAP data to preserve endpoint evidence for investigations. This skill centralizes gathering evidence across incident response, forensic analysis, and compliance workflows.

Yes, automated and offline forensic artifact collection is supported using D&R rules and Reliable Tasking. This ensures endpoint evidence is gathered continuously even when systems are offline, preserving critical data for incident response and compliance investigations.

For forensic timeline creation, you can gather memory dumps, Windows Event Logs, Mac Unified Logs, and PCAP data. Collecting these specific artifacts helps analyze malware behavior and reconstruct incident timelines across on-prem and cloud environments.

Yes, collecting PCAP data and memory dumps requires the Artifact extension and Reliable Tasking. These components enable automated, offline, and real-time collection of forensic evidence across endpoints via D&R rules.

The best way to preserve suspicious files for forensic investigations is to hash the file to verify integrity, then collect it along with related artifacts. This preserves evidence for malware analysis and incident response workflows.