Pre-Positioned Agent
Definition
Lightweight endpoint software deployed across the organisation before any incident occurs. When an incident is declared, the IR team tasks agents remotely to collect memory dumps, process lists, registry snapshots, or log files without physical attendance. Examples include Velociraptor, OSQuery, and commercial EDR platforms.
- Deployment timing
- Before any incident occurs
- Function
- Remote collection without physical attendance
- Collects
- Memory dumps, process lists, registry, logs
- Examples
- Velociraptor, OSQuery, commercial EDR platforms
Common questions
What advantage does a pre-positioned agent give an IR team?+
It removes the delay of physically travelling to an affected endpoint, letting responders trigger volatile data collection across many machines within minutes of declaring an incident, which matters because memory and process data change or disappear quickly.
How does a pre-positioned agent differ from a triage tool brought to the scene?+
A triage tool must be deployed and run after the fact, often after volatile evidence has already been lost, whereas a pre-positioned agent is already installed and ready, so readiness planning before an incident directly shapes what evidence survives to collect.
Related terms
- Forensic Readiness
- The organisational state in which people, processes, and technology are prepared to collect and preserve digital evidence with minimum disruption to business...
- ISO/IEC 27037
- An international standard providing guidelines for the identification, collection, acquisition, and preservation of digital evidence. Published by ISO in 2012. Used by...
- Jump Bag
- A pre-packed kit containing the hardware and media required for immediate on-site forensic response: write-blockers, imaging drives, bootable USB, cables, evidence labels,...
- Order of Volatility
- The sequence in which digital evidence should be collected, ranked from most to least transient. Defined in RFC 3227. CPU registers and...
- Write Blocker
- A hardware or software device interposed between a digital storage medium and the forensic workstation that prevents any write commands from reaching...