RA1020: Prepare Acquisition Profiles

Summary

ID	RA1020
Brief Description	Prepare acquisition profiles
Author	@SEC
Creation Date	2023/05/20
References	https://github.com/certsocietegenerale/IRM/blob/main/EN/IRM-2-WindowsIntrusion.pdf
Response Stage	Preparation

Description

Acquisition profiles for EDR or tools like FastIR, DFIR Orc, KAPE must be prepared.