You can acquire triage collections from hosts using the Endpoint Security (HX) Web UI. Triage collections provide a snapshot of what occurred on a host endpoint around the time of an alert.
Multiple triages can be requested simultaneously from a host. In addition, you can select multiple hosts and request triage collections from them.
You can select the custom triage collection instead of the default triage to control the content requested for a triage. A preconfigured custom triage script is included with the software. You can modify the preconfigured custom triage script using the Data Acquisitions Scripts menu option in the Endpoint Security (HX) Web UI. This allows you customize what is retrieved in the collection.
You can perform triages for your Windows, macOS, and Linux endpoints.
Note
Triages can be performed for Linux endpoints running Endpoint Security (HX) Agent version 30 or later.
See Requesting triage acquisitions for more information.