Product · Automated forensics
Forensics on autopilot. Answers on demand.
Most incident response tools start collecting evidence after someone reads the alert. ThreatBreaker collects endpoint forensics the moment a critical detection fires, keeps it in an evidence package with chain of custody, and exports it for whoever needs the answer.
Collected without touching the host. Kept with the incident. Exported as PDF, ZIP, STIX or a custody record.
Why most incident response tools collect evidence too late
On most endpoints, forensics begins after an analyst reads the alert, opens a ticket and decides to look. By then processes have exited, temporary files are gone and the attacker may have cleaned up.
ThreatBreaker treats evidence collection as part of detection, not a separate job afterwards. On a critical detection the engine gathers the forensic artifacts straight away, without changing anything on the machine, and attaches them to the incident.
- Detect→
- Collect evidence→
- Reconstruct→
- Explain→
- Respond
What goes into an evidence package
Every package stays linked to the incident and the endpoint it came from. Open one to see what a responder gets.
Credential dumping · WS-FIN-02 · Windows 11 Pro
Illustrative incident data.
Chain of custody and a hash-verified audit trail
Each custody entry is hash-linked to the one before it, so a chain that was truncated, reordered or edited fails verification, and a finalised package carries an integrity hash that can be re-derived from its own contents. Forensic and AI decisions are also written to an append-only trail with a SHA-256 hash of each input and output.
- ✓Every automated action is recorded on the server.
- ✓Evidence is retained according to policies you configure.
- ✓Four collection templates, for data breach, incident response, malware analysis and ransomware, set which artifacts a package must contain.
- ✓Deleting data leaves a tombstone: who deleted what and when, with the content redacted.
To be precise: these are content-integrity hashes for tamper evidence, not per-record cryptographic signatures. Plain collection records are kept too, and labelled as a handling log, not tamper-evident.
Remote evidence collection, on your terms
By default the agent sends event metadata, not file contents. When a case needs more, an operator asks for it, and the request is on the record.
Pull what the case needs
Request a screenshot or a file from the endpoint, or run one of more than thirty remote commands.
Every retrieval is audited
Each host's command history lists every piece of data ever retrieved from it.
See where else it is
Hunt the whole fleet for a hash, file name or path, and act on every match at once.
Offline and air-gapped
Collection runs on the endpoint; on-premise deployments keep every artifact inside your perimeter.
Digital forensics and incident response in one console
DFIR usually means one set of digital forensics tools or software for evidence and another for incident response. ThreatBreaker keeps both in one console: the evidence package, the host timeline, a company-wide MITRE ATT&CK coverage view of techniques actually observed, and the response.
For MSSPs and forensic consultancies, the same console is multi-tenant and white-label, so each client's evidence stays in its own tenant.
Who reads the evidence first?
The AI triage writes the case from this evidence before your analyst opens it.
How triage works →Incident response and forensics questions
- What are incident response tools?
- Incident response tools help a security team contain an attack and understand it: collecting evidence, reconstructing what happened and acting on the affected machines. ThreatBreaker combines evidence collection and response in one console.
- What is DFIR?
- Digital forensics and incident response: collecting and preserving evidence from systems (forensics) while containing and recovering from the attack (incident response).
- What is chain of custody for digital evidence?
- A record of who collected, handled, reviewed and exported each piece of evidence, and when. ThreatBreaker keeps it with every evidence package and exports it as a custody record.
- Can I collect forensic evidence remotely?
- Yes. Evidence is collected automatically on critical detections, and an operator can request screenshots, files or remote commands from any endpoint. Every retrieval is logged per host.
- Is the audit trail tamper-proof?
- It is tamper-evident: custody entries are hash-linked, so a truncated, reordered or edited chain fails verification, and each forensic and AI decision is stored with a SHA-256 hash of its input and output. The hashes are not cryptographic signatures.
- Which formats can I export?
- Forensic PDF reports with a TLP marking, ZIP archives of the artifacts, STIX data and chain-of-custody records.
- How long is evidence kept?
- Retention is configurable. In our standard SaaS policy, incidents and forensic data are kept for 180 days; on-premise deployments keep everything under your own retention rules.
See an evidence package from a real incident.
Thirty minutes: the timeline, the artifacts, the custody log and the export, on one incident.