Understand suspicious software and its observed behaviour
Analyze suspicious software and endpoint evidence to assess behaviour and impact, then coordinate authorized containment or remediation within the agreed engagement.
Investigation and follow-up
Examine collected artifacts and observed execution
Identify behaviours and indicators that guide further investigation
State what the available evidence supports and what remains unknown
Recommend and coordinate authorized response with your security team
SNOW combines endpoint telemetry and detection modules with deterministic automation and human-led investigation. Analysts can request follow-up evidence and use supported response actions within the deployment’s permissions and agreed scope. Telemetry collection is distinct from human-review coverage or an emergency-response commitment.