Artifact Collector

About

Streamlines digital forensics and incident response (DFIR) by providing structured guidance for gathering critical evidence from remote endpoints across Windows, macOS, and Linux. It facilitates the collection of volatile data like process memory and network connections, as well as persistent artifacts like event logs and filesystem metadata. By leveraging LimaCharlie's Artifact and Reliable Tasking extensions, it enables automated evidence preservation through Detection & Response rules and ensures collection tasks are successfully executed even on sensors with intermittent connectivity.

Key Features

• Implementation patterns for automated evidence collection via D&R rules
• Comprehensive evidence collection including files, memory dumps, and MFT data
• Reliable Tasking support for queuing collection commands on offline sensors
• Real-time streaming and historical retrieval of Windows Event Logs and Mac Unified Logs
• 0 GitHub stars
• Advanced memory analysis tools for process mapping, string extraction, and IOC searching

Use Cases

• Conducting deep forensic analysis and timeline creation during incident response
• Investigating suspicious process behavior or potential malware infections in real-time
• Automating the capture of volatile data for compliance and evidence preservation