Forensics Watch

The Forensics Watch does deep research on threats and exploits, running forensics on an attack.

Worker	What it does	Works with
Endpoint Analysis	Reconstructs the attack timeline on one affected host and proposes response actions.	The Attack Discovery Worker in the Triage Watch, which hands off the attacks this Worker investigates.

When to turn on the Forensics Watch

Turn on the Forensics Watch when you want AlertZero to investigate confirmed attacks on an affected host. It works only on attacks that the Attack Discovery Worker hands off, so turn it on together with the Triage Watch. It also needs data from Elastic Defend on your hosts.