Forensics overview

Public API endpoints for browsing forensic investigations, their hunt and triage collections, and the artifact data collected for them.

Required licenses: All API endpoints require a Cortex XDR license with endpoints and the Forensics add-on. RBAC permission: Forensics > View, which is included in the following built-in roles: Viewer, Investigator, Privileged Investigator, and Administrator.