Incident Response

For internal SOC teams and DFIR consultants alike, collecting triage data from an infected system is often one of the few things they do when an incident comes in.