Illusive-Collect-Forensics-On-Demand

Inputs

• fqdn_or_ip — The host FQDN or IP address on which to collect forensics.
• start_date — The starting date of the forensics timeline.
• end_date — The last date of the forensics timeline.

Outputs

• Illusive.Forensics.Evidence.details — The forensics evidence details.
• Illusive.Forensics.Evidence.eventId — The event ID.
• Illusive.Forensics.Evidence.id — The forensics evidence ID.
• Illusive.Forensics.Evidence.source — The evidence source.
• Illusive.Forensics.Evidence.starred — Whether the forensics evidence has been starred.
• Illusive.Forensics.Evidence.time — Date and time of the forensics evidence.
• Illusive.Forensics.Evidence.title — The forensics evidence description.
• Illusive.Forensics.IncidentId — The incident ID.

Commands used