Endpoint Forensic Snapshot

Endpoint Forensic Snapshot is a security investigation artifact that captures system state for later review for user device and server protection. It uses logs, configuration, hashes, and time-bounded data so teams can analyze incidents without changing evidence while keeping evidence, reliability, and public-safe operational boundaries clear.

“The security team used Endpoint Forensic Snapshot when a workstation reported suspicious activity, so the team could analyze incidents without changing evidence before the risk review began.”