Industry-First Automated Cloud Forensics

Darktrace has launched the industry’s first truly automated cloud forensics solution, Darktrace / Forensic Acquisition & Investigation, designed to bring automated forensic investigations to security teams of all sizes. According to Darktrace, the platform captures, processes, and analyses forensic evidence of cloud workloads instantly, triggering automated acquisition whenever an alert is raised and reconstructing attacker timelines in minutes rather than days.

It integrates with cloud-native providers, XDR platforms, and SIEM/SOAR tools without requiring customers to replace their detection stack, and is natively integrated with Darktrace / CLOUD to preserve evidence from suspected cloud assets. The solution provides automated evidence collection across AWS, Microsoft Azure, GCP and on‑prem environments, supporting full volume capture as well as triage collection for speed.

It also enables SaaS log collection from Microsoft 365, Entra ID, and Google Workspace to investigate threats such as business email compromise and account takeover, and offers proactive vulnerability and malware discovery for Linux-based cloud resources. Two deployment options are available—Self-Hosted Virtual Appliance and SaaS-Delivered Deployment—scaling across regions and accounts to suit different needs, with the post published on 25 September 2025.