Opening a session
Select a host on the Hosts page and open its response panel, or go to Response and pick the host. Every action in the panel reaches the agent with your identity attached and is recorded in the audit trail.
Processes
The Processes tab lists running processes with parent, user, executable path and command line. From a row you can:
- Kill: terminate the process.
- Suspend and Resume: freeze a process for inspection without ending it.
- Open in Logs: jump to the process's events by its identifier.
Files
The Files tab is a read-only explorer of the host filesystem with:
- listing and stat, including timestamps and owner;
- a capped text preview;
- file type detection by content rather than extension;
- MD5, SHA-1 and SHA-256 hashing of a whole file, for threat intelligence lookups;
- Collect: pull the file into the case evidence.
Collected files are transferred over an encrypted connection and tracked from the moment of request. Downloads from the console come in a password-protected archive, so the evidence reaches the analyst intact even with antivirus running on their workstation. The console shows the maximum file size.
Shell
The Shell tab opens an interactive terminal on the host: PowerShell or cmd on Windows, the login shell on Linux. Sessions are authorized with a short-lived ticket bound to your identity and to that single host, and everything typed is recorded in the session transcript.
Use the shell for what the other tabs cannot do. Prefer the structured actions when they exist; they are easier to audit and to reverse.
Permissions
Response actions require the analyst or lead role with a grant on the host's organization. Viewers can see the tabs. See Users and roles.