drop forensic artifact csvs · CERT/NITTF behavioral rubric · composite risk profile · runs locally
artifact csvs
drop file access, logon, email, usb, browser csvs
or click
file access · logon · email · usb · print · browser · network — investigative leads only, not conclusions
drop forensic artifact csvs for one user