Security tools can generate an alert in seconds. Determining what happened, how far the activity spread, and what evidence supports the response can still take hours or days.

This webinar introduces a practical five-step approach to endpoint investigations: Validate → Scope → Preserve → Reconstruct → Report. Learn how to turn an alert into documented findings that explain what happened and show the evidence behind each conclusion.

Using Exterro ARMOUR for FTK, we’ll demonstrate how agentic AI works with FTK Central to coordinate authorized forensic work across live enterprise endpoints. Investigators begin with a plain-language objective, while Exterro’s forensic technology performs inspection, targeted collection, artifact analysis, correlation, and timeline development. We’ll show how these activities work together, including when volatile evidence needs immediate preservation. Investigators remain responsible for scope, validation, and final decisions throughout the process.

Attendees will learn how to reduce repetitive manual work, identify affected users and systems sooner, and communicate findings that security, legal, compliance, and executive stakeholders can review and verify.

Learning Objectives: 

1. Apply a five-step framework to progress from a security alert to documented, evidence-supported findings.
2. Develop plain-language objectives for initiating authorized forensic work across live endpoints.
3. Determine incident scope and identify methods for preserving time-sensitive evidence before it changes or disappears.
4. Reconstruct incident activity and document findings using practices that maintain investigator oversight and a reviewable record of investigative actions.

LIVE ATTENDEES: Earn 0.1 CEU*  As an IACET Accredited Provider, BNP Media offers IACET CEUs for its learning events that comply with the ANSI/IACET Continuing Education and Training Standard. Participants completing this course may be eligible to receive Continuing Professional Education (CPE) credits toward ASIS recertification. To be eligible for CE credit and a certificate of completion, live attendees must attend the webinar for a minimum of 45 minutes and successfully complete a required 4-question post-event assessment associated with the webinar. Credit and certificates will be issued automatically upon successful completion of these requirements. CEUs are not offered for on-demand viewing of this webinar.

Sponsored by: