Defense · Distilled (purple) · Empirical Sciences corpus
Investigator’s kit for after the incident — disk imaging, memory dumps, log correlation, timeline reconstruction. Behavioral Antivirus stops the attack in progress; this reconstructs what happened after.
