Press CTRL+K to open search

Reviewing forensic data

  • Published on Aug 26, 2026
  • 1 minute(s) read
Prev Next

You can review forensic data you have collected from your host endpoints.

Note

If the sum of the unzipped sizes of the audits included in an acquisition (or triage collection) exceeds 3 GB, an error message displays indicating that the acquisition cannot be viewed in the Audit Viewer or in the Triage Viewer.

Exploit Guard data cannot currently be viewed in the Audit Viewer.

Timestamps in the Web UI are presented in UTC time.

Prerequisites

  • Analyst, Senior Analyst, Investigator, or Admin access

Related articles
  • Reviewing forensic data in the Audit Viewer
    Endpoint Detection and Response with Forensics (EDRF) > Investigate potential threats with EDRF > Analyzing forensic data > Reviewing forensic data > Reviewing forensic data in the Audit Viewer
  • Reviewing forensic data in Redline
    Endpoint Security (HX) > Endpoint Security (HX) Server 10.x User Guide > Analyzing forensic data > Reviewing forensic data
  • Downloading forensic data
    Endpoint Security (HX) > Endpoint Security (HX) Server 10.x User Guide > Analyzing forensic data