From endpoint activity to defensible findings

Endpoint & Forensics

Learn how defenders protect endpoints, preserve volatile evidence, and turn host activity into reliable findings. Start with the concepts, explore a focused tool, or build an investigation lab.

Find my path Start the foundations

Endpointevidence preserved

3learning routes 2practical tools 5readiness checks

01

Follow the endpoint evidence

Select each stage to see how an examiner moves from a live system to a supported finding.

01ScopeDefine the question and authority 02PreserveProtect volatile evidence 03CollectAcquire relevant artefacts 04AnalyseTest explanations 05ReportRecord supported findings

Stage 1 Define the question and authority

Identify the device, user, time range, investigation question, and authorised actions before touching the endpoint.

Ask: What am I permitted to examine, and what decision must the evidence support?

02

Find your learning path

Choose what you want to achieve. The page will highlight the best place to begin.

I am new to endpoint security I want to detect endpoint threats I want to investigate a host

Best match Learn the foundations

Understand endpoint telemetry, response, evidence integrity, and investigation principles before choosing a tool.

Recommended firstLearn the foundations Build the vocabulary for endpoint detection, response, evidence acquisition, and forensic analysis. Level Beginner Setup None Time 60 to 90 min Outcome Explain how endpoint activity becomes a defensible finding. Endpoint detectionExplore endpoint activity Use Aurora Lite to collect useful Windows telemetry and examine activity that warrants investigation. Level Beginner to intermediate Setup Windows lab Time 1 to 3 hours Outcome Collect and review endpoint evidence for suspicious behaviour. Digital forensicsInvestigate an endpoint Use Velociraptor to acquire artefacts, hunt across hosts, and preserve investigation context. Level Intermediate Setup Isolated lab Time 2 to 5 hours Outcome Produce a traceable endpoint investigation with supported findings.

03

Build your foundation

Complete these concept guides before collecting evidence from a real endpoint.

1

Endpoint securityUnderstanding EDR

Collect endpoint telemetry, detect suspicious behaviour, investigate, and respond.

2

Digital forensicsUnderstanding DFIR

Preserve evidence, reconstruct activity, test explanations, and report findings.

04

Choose a tool by task

Start with the question you need to answer, then use the smallest toolset that can answer it.

EDRCollect endpoint telemetryWindows events, detections, and local investigation DFIRAcquire and hunt for artefactsRemote collection, queries, timelines, and evidence

Best starting point for focused Windows endpoint telemetry Aurora Lite

Generate and review useful Windows endpoint telemetry in a focused lab before moving to fleet-wide collection or deeper forensic acquisition.

Also consider Velociraptor when you need remote artefact collection, repeatable hunts, or investigation across several endpoints.

Explore Aurora Lite

05

Check your investigation readiness

Complete these checks before collecting data, running hunts, or changing an endpoint.

!

Preparation requiredComplete all five safety checks before starting.

I own the endpoint or have written permission to examine it. I documented the device, user, time range, and investigation question. I know which evidence is volatile and what must be preserved first. Evidence storage is protected, timestamped, and large enough for the collection. I can record collection steps, hashes, tool versions, and every change made.