The Endpoint Security (HX) can obtain the following types of forensic data.
In addition, you can search your enterprise for specific rule conditions. See Investigate threats using Enterprise Search.
You can configure how acquisitions are run, stored, and aged by the Endpoint Security (HX). For details, see Configuring acquisition settings.