Agent Operations
Incident Evidence Capture
Also: evidence preservation
Copying the logs, files and configuration of an incident to a store the affected system cannot change, before cleanup or rebuilding.
In more detail
For an agent incident this means session records, tool and command logs, relevant files, configuration and the policy version in force, with timestamps and a note of who captured what. Rebuilding first can destroy the very evidence needed to find the cause.