Phantom

Where is it used?

Phantom can start a Cyber Triage endpoint investigation as part of a workflow.

Why is it useful?

Allows you to more quickly start an endpoint investigation and make the best use of incident responder’s time because the data will be ready for review when they are assigned to the alert.