Forensic Artifacts: Collecting files from endpoints

Cyber Protection Endpoint Detection and Response (EDR) enables analysts and security teams to collect suspicious file samples from endpoints and store them centrally in a secure cloud repository. These collected files, called Forensic Artifacts, support investigation, threat research, and automated analysis workflows.

What is Forensic Artifacts?

Forensic Artifacts is a secure centralized repository where all file samples collected from your endpoints are stored and managed. When you collect a file from an endpoint during an investigation:

  • The file is packaged as a password-protected encrypted archive.
  • It is uploaded to secure cloud storage.
  • It is stored with full metadata (hash, path, host, timestamp, file size, and who requested the collection).
  • It is retained for 180 days, then automatically deleted.
  • All access is logged for compliance and audit purposes.

Why collect files?

While EDR detects threats and provides detailed activity information, you sometimes need the actual file samples for deeper investigation. File collection enables you to:

  • Deepen investigation — analyze the actual malicious file, not just hashes and metadata.
  • Support threat research — submit files for sandbox analysis or static analysis.
  • Meet compliance requirements — maintain audit trail of forensic activities.

How does file collection work?

When you request a file collection:

  1. The system sends a collection task to the endpoint where the file is located.
  2. The endpoint agent reads the file and packages it as a password-protected ZIP archive.
  3. The archive is uploaded to secure cloud storage.
  4. The system records the collection event in your audit log.
  5. The file appears in the Forensic Artifacts page where you can download it, view details, or delete it.

Key security features

File collection is protected by multiple security layers:

  • Role-Based Access Control (RBAC) — only users with "Collect Files" or "Download Collected Files" permissions can perform these actions.
  • Password protection — every collected file is encrypted with a unique password, displayed to you only at download time.
  • Audit logging — all collection, download, and deletion actions are logged with user, timestamp, file, and host information. Password values are never logged.
  • Encrypted storage — files are encrypted at rest in secure cloud storage, separate from other product data.
  • Automatic purge — files are automatically deleted after 180 days to manage storage and comply with data retention policies.

Who can use Forensic Artifacts?

Forensic Artifacts is available at the customer account level for these roles:

  • Cyber Administrator — can collect files, download files, and delete files.
  • Company Administrator — can collect files, download files, and delete files.
  • Security Analyst — can collect files, download files, and delete files.

Related topics