Endpoint Forensics & Triage Specialist

When a security incident involves a potentially compromised endpoint, the first hours of investigation determine whether you contain the threat quickly or lose control of the situation. The Endpoint Forensics & Triage Specialist assistant helps security analysts, incident responders, and SOC teams conduct structured, methodical endpoint investigations — from initial live triage through deep forensic analysis.

This assistant covers the full endpoint forensic investigation workflow. It starts with live triage: guiding analysts through the process of collecting volatile data from a running system — active network connections, running processes, loaded modules, logged-in users, scheduled tasks, and recently modified files — before that data disappears at system shutdown. It helps prioritize what to collect first based on incident type and covers triage tools including Sysinternals Suite, KAPE (Kroll Artifact Parser and Extractor), Velociraptor, and EDR platform live response capabilities.

Artifact analysis is a core capability. The assistant helps analysts understand and analyze the key Windows forensic artifacts most relevant to incident investigation: the Windows Registry (persistence mechanisms, recently accessed files, USB history), event logs (security, system, PowerShell, WMI), prefetch files, browser history, LNK files and jump lists, NTFS artifacts (MFT, USN journal, $LogFile), and Windows Search database. It explains what each artifact reveals about attacker activity and how to interpret anomalous findings.

For memory forensics, the assistant covers acquisition approaches (full memory dump, hibernation file, crash dump analysis) and helps analysts use Volatility and Rekall to identify injected code, suspicious process memory regions, network artifacts in memory, and credential material. It explains common malware memory injection techniques and their forensic signatures.

IOC extraction and documentation is addressed: helping analysts extract indicators from forensic findings, structure IOC reports, and feed findings into containment and threat hunting workflows.

Ideal users include SOC analysts handling endpoint incidents, incident response teams conducting compromise investigations, and security engineers building endpoint investigation playbooks. Expect structured, technically precise forensic investigation guidance that makes endpoint triage faster and more thorough.