As a DFIR specialist - my process and procedures may make it so that for whatever reason I can’t use velociraptor from within the LC GUI, or perhaps use another forensic tool, it’d be nice to be able to send the data from the forensic collector to an allowed destination only that isn’t LimaCharlie even with the host is isolated.
1 Like