LIVEcommunity - Who rated this article

Buy or Renew

Forensics Module - Part 1

Part 1 of the webinar series Discover the World of Forensics covers the Forensics module overview, the reasons why and how to harness this module, a review of the ideal order of Forensics evidence collection, and introduces Forensic artifacts and terms.

(view in My Videos)

Additional resources:

Commands:

PSReadLine:
Get location with: Get-PSReadlineOption
%userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt
DNS Cache:
Get list with: Get-DnsClientCache
ipconfig /displaydns
XDR Admin Guide Forensics Module:
https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Forensics-A...

Have a question? Post it on our Discussions forum

Cortex XDR