Collect and manage digital evidence to support threat investigation and incident response.
Forensics
Evidence Archive allows you to collect and manage evidence packages from the endpoints in your environment.
The following table outlines the actions available for Evidence Archive.
|
Action
|
Description
|
||
|
Click Collect Evidence to gather evidence from the endpoints in your environment.
|
|||
|
Filter endpoints
|
Use the search box and filters to locate specific endpoints.
|
||
|
View evidence packages collected from an endpoint
|
Identify an endpoint and click
 to display all packages collected from an endpoint.Evidence Archive displays the following information about evidence packages:
|
||
|
Take additional actions
|
Click
 and select an additional action:
|
): Forensicsis processing the evidence. 
): Forensicsprocessed the evidence.
): Forensics could not process some of the evidence types in the package.
): An error or time-out occurred when processing the evidence package.