MSP and consulting IR
Intake a client collection → process supported artifacts → record analyst decisions → export a consistent evidence-backed report package.
1
Intake
Open the client case with timezone and analysts. Client/case records organize work. That is not a claim of security-grade multi-tenancy or hard tenant isolation unless separately implemented and tested.
2
Process supported artifacts
KAPE/Velociraptor packages, EDR exports, RMM, firewall, optional memory or PCAP.
3
Record decisions
Accept IOCs and findings. AI can stay off when the client forbids model egress.
4
Export the package
A reviewable report that traces findings to supplied evidence and states gaps.