FORENSIC
This job template is designed to retrieve information that takes an increased amount time to investigate as opposed to information for immediately triaging an incident – the retrieved information would otherwise have little value if there were no incident with indicators leading to it as potential evidence. Triage data will answer "what" happened, while forensic data will follow-up and usually answer "how" or "why" it happened.
| Job Metadata | |
| Name | FORENSIC-TEMPLATE |
| Plugin Selection | |
| 📷 Collectors | Custom Plugins:
|
Built-in Plugins:
| |
| ⛙ Transports |
|
| 🔍 Analyzers |
|