Request a walkthrough
Endpoint activity for connected investigations
The sensor provides the host-side evidence behind SNOW’s investigations. Process activity, connections and configured collectors give analysts a way to examine what happened on an enrolled endpoint—not just the alert that brought it to their attention.
SNOW is an additional investigative layer alongside your existing security tools. Collection and compatibility are reviewed for the systems and workloads in scope.
Capabilities vary with the operating system, sensor version and enabled profile. Depending on the deployment, the evidence available can include:
That context helps distinguish an expected management task from a relationship or behaviour that deserves investigation.
Memory and covert-execution findings add another view of a process. Analysts can review indications of shellcode or injection alongside its ancestry, persistence and connections, using the artifacts that are available to collect or have been retained.
A clean on-disk file does not resolve every in-memory finding. Equally, an unavailable memory artifact or a file that has disappeared is a limit on the evidence—not proof that the activity was harmless.
Process and parent context give the backend AI-agent module evidence for recognizing supported tools and relating the child processes they launch. This follows activity observed on the endpoint; it is not a transcript of the model’s reasoning.
Activity tracking, account identity and configuration inventory are different capabilities. Review the current module and enabled collection profile for your deployment rather than assuming a tool’s name establishes its account, permissions or policy compliance.
Review operating systems, workloads, existing security tools and the collectors required. Validate a representative rollout under agreed change control before extending the deployment.
Resource use and collection volume depend on activity and settings. Use representative measurements for your environment rather than a universal per-host footprint estimate.
Agree which records are collected, where they are processed, who can access them and how long they are retained. Follow-up collection and response tasks stay within the permissions and scope of the engagement.
The technical overview below describes collection, evidence and deployment boundaries, with the original 2016 notes retained as an archive. Match the documentation to the released version and enabled profile; the overview is not a security attestation or a promise that every collector is enabled on every platform.
