Phase 4: Collection of Forensic Data
Table of Contents
4.2 (EoS)
Expand all | Collapse all
-
- Set Up the Endpoint Infrastructure
- Activate Traps Licenses
-
- Endpoint Infrastructure Installation Considerations
- TLS/SSL Encryption for Traps Components
- Configure the MS-SQL Server Database
- Install the Endpoint Security Manager Server Software
- Install the Endpoint Security Manager Console Software
- Manage Proxy Communication with the Endpoint Security Manager
- Load Balance Traffic to ESM Servers
-
- Malware Protection Policy Best Practices
- Malware Protection Flow
- Manage Trusted Signers
-
- Remove an Endpoint from the Health Page
- Install an End-of-Life Traps Agent Version
-
-
- Traps Troubleshooting Resources
- Traps and Endpoint Security Manager Processes
- ESM Tech Support File
-
- Access Cytool
- View the Status of the Agent Using Cytool
- View Processes Currently Protected by Traps Using Cytool
- Manage Logging of Traps Components Using Cytool
- Restore a Quarantined File Using Cytool
- View Statistics for a Protected Process Using Cytool
- View Details About the Traps Local Analysis Module Using Cy...
- View Hash Details About a File Using Cytool
Phase 4: Collection of Forensic Data
After analyzing the files, Traps notifies the ESM about
the security event and can send additional forensic data to the
forensic folder.
If your security policy contains a forensic data collection rule,
Traps collects one or more specified data types and uploads the
file(s) to the forensic folder. Depending on the preferences, Traps
can collect URI that were accessed, drivers, files, and relevant
DLLs that are loaded in memory under the attacked process, and ancestor processes
of the process that triggered the security event. For more information,
see Define Forensics Collection Preferences.
By default, Traps uses a web-based Background Intelligent Transfer
Service (BITS) folder that utilizes idle network bandwidth to upload
data. For more information, see Change the Default Forensic Folder.
You can also manually retrieve forensic data for a specific security
event by creating a one-time action rule to retrieve the data. For
more information, see Retrieve Data About a Security Event.
To view the status of the forensic upload select MonitorData Retrieval.