Cortex XDR Customer Success Webinar: Uncover the Power of Forensics - Part 1

[rtsedaka]

Forensics Module - Part 1

Part 1 of the webinar series Discover the World of Forensics covers the Forensics module overview, the reasons why and how to harness this module, a review of the ideal order of Forensics evidence collection, and introduces Forensic artifacts and terms. 

Additional resources:

Commands:

• PSReadLine:
  Get location with: Get-PSReadlineOption
  %userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt
• DNS Cache:
  Get list with: Get-DnsClientCache
  ipconfig /displaydns
• XDR Admin Guide Forensics Module: 
  https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Forensics-A...

Have a question? Post it on our Discussions forum

Cortex XDR