Abstract: The present disclosure provides techniques for fine-grained access to system commands run via an installed agent application. A processing device receives, from an agent application, a user identifier and an indication of an agent application command with respect to a target endpoint, wherein the agent application command is included in a plurality of agent application commands assigned to a first user type that is different from a second user type corresponding to the user identifier. The processing device maps the agent application command to a permission level assigned to the agent application command. The processing device determines, based on the mapping, that the permission level is assigned to the user identifier. The processing device enables, based on the determination, the agent application to execute the agent application command with respect to the target endpoint.

Abstract: Real-time forensic instrumentation comprising: a monitoring hook into the notification interface of an operating system; a forensic artifact filter to evaluate events received via the real-time monitoring hook to determine if an event represents a change to a forensic artifact; and a forensic interpreter subsystem to: based on the forensic artifact filter output, collect forensic metadata associated with the forensic artifact and apply a forensic analysis to the forensic artifact to generate a result; generate a forensically interpreted activity for the event, the forensically interpreted activity comprising the forensic metadata, the result of the forensic analysis and a description of a first activity by a user with respect to the forensic artifact; and store the forensically interpreted activity in a digital forensics store.

Abstract: Real-time forensic instrumentation comprising: a monitoring hook into the notification interface of an operating system; a forensic artifact filter to evaluate events received via the real-time monitoring hook to determine if an event represents a change to a forensic artifact; and a forensic interpreter subsystem to: based on the forensic artifact filter output, collect forensic metadata associated with the forensic artifact and apply a forensic analysis to the forensic artifact to generate a result; generate a forensically interpreted activity for the event, the forensically interpreted activity comprising the forensic metadata, the result of the forensic analysis and a description of a first activity by a user with respect to the forensic artifact; and store the forensically interpreted activity in a digital forensics store.

Abstract: Real-time forensic instrumentation comprising: a monitoring hook into the notification interface of an operating system; a forensic artifact filter to evaluate events received via the real-time monitoring hook to determine if an event represents a change to a forensic artifact; and a forensic interpreter subsystem to: based on the forensic artifact filter output, collect forensic metadata associated with the forensic artifact and apply a forensic analysis to the forensic artifact to generate a result; generate a forensically interpreted activity for the event, the forensically interpreted activity comprising the forensic metadata, the result of the forensic analysis and a description of a first activity by a user with respect to the forensic artifact; and store the forensically interpreted activity in a digital forensics store.