Why does an incident-response team agree its triage collection profile before any case exists?

## The problem the standing profile solves The moment you need to collect from hundreds of endpoints is the worst possible moment to decide what to collect. Under time pressure you will either under-collect - and discover a week later that the artefact answering the case was never in the archive, by which time it has rolled off the host - or over-collect, and drown the estate, the network and your own analysts. Both failures are permanent in a way that is easy to underestimate: **a wide sweep is effectively one-shot**, because rerunning it days later returns a host whose short-lived artefacts have aged out and whose state the adversary may have changed. So the profile is agreed in advance, versioned, and rehearsed. ## What you can only learn by testing it beforehand - **Runtime and output size per host.** These are the numbers that decide whether a sweep of the whole estate is even possible. A profile that takes four minutes and yields 150 MB is a different animal from one that takes forty minutes and yields 4 GB, and you find out which you have by running it, not by reading the artefact list. - **The worst host, not the average one.** An eight-year-old laptop on a hotel connection is the constraint. Test there. - **Aggregate load.** 900 hosts uploading simultaneously is a network event and a storage event. Staging - batches, rate limits, off-peak scheduling - is part of the profile design. - **Privilege, tooling and conflicts.** Whether the collector runs with the rights it needs, whether the endpoint security product blocks or quarantines it, whether disk encryption or a locked file blocks a hive read. - **Downstream fit.** Every artefact you collect has to be parsed into something searchable. An artefact nobody can parse is a file you paid to move. ## What goes in, and what is deliberately left out The inclusion test is blunt: *does this artefact answer a question we ask in most incidents, at a cost we can pay times the whole estate?* A typical Windows profile therefore carries event logs (Security, System, PowerShell, Sysmon where present), filesystem metadata such as the MFT and USN journal, registry hives, execution artefacts such as prefetch, scheduled tasks and services, shell history, and a live process/network/logged-on-user snapshot. The Linux equivalent is system and audit logs, shell histories, cron and unit files, package state and a process snapshot. What is normally excluded, and why the exclusion is a decision rather than an oversight: - **Full memory images from every host** - hundreds of gigabytes across the estate and minutes of high-impact collection each. Memory is a per-host escalation, not a fleet-wide default. - **User document trees and mail stores** - enormous, mostly irrelevant, and the single most privacy-sensitive thing on the machine. - **Full packet capture** - not an endpoint artefact and not sustainable at scale. - **Whole-disk artefacts that only matter when a host is already the subject** - browser caches, hibernation and page files, deleted-space recovery. These live in the escalated profile. ## The organisational half A collector that reaches into a user's machine is a privacy question, not just an engineering one. In some jurisdictions and with some employee-representation regimes you need the profile's contents agreed - what categories it touches, what it explicitly excludes, who may authorise a sweep, and how long the collection is kept. Doing that once, in advance, in writing, is what makes the 03:00 sweep an execution step rather than a negotiation. It also means the answer to *why did you take that from my laptop* is a document, not an improvisation. ## Keeping it a floor and not a ceiling The standing profile is the default, and defaults must have escape hatches: 1. A **per-case extension** mechanism - add the artefact this incident actually needs, recorded in the case notes with who approved it. 2. A **promotion path** - the small number of hosts that come back interesting get a deeper collection, memory, or a full image. 3. A **review cadence** - the profile ages. New products, a new EDR, a new OS version, or an incident where the archive turned out to be missing something all feed a revision, and the profile carries a version so you can say which one produced a given archive. The interview answer that lands is this: the profile is a pre-negotiated, pre-measured, versioned default that makes a wide collection fast and comparable, plus an explicit route to go deeper on the few hosts that earn it.