{"id":8929,"date":"2026-10-19T19:36:32","date_gmt":"2026-10-19T16:36:32","guid":{"rendered":"https:\/\/support.withsecure.com\/support-articles\/what-log-files-are-included-in-the-elements-endpoint-detection-and-response-forensics-package\/"},"modified":"2026-10-19T19:36:32","modified_gmt":"2026-10-19T16:36:32","slug":"what-log-files-are-included-in-the-elements-endpoint-detection-and-response-forensics-package","status":"publish","type":"support_article","link":"https:\/\/support.withsecure.com\/fi\/support-articles\/what-log-files-are-included-in-the-elements-endpoint-detection-and-response-forensics-package\/","title":{"rendered":"What log files are included in the Elements Endpoint Detection and Response forensics package?"},"content":{"rendered":"<h3>Issue:<\/h3>\n<p>What log files are included in the Elements Endpoint Detection and Response forensics package archive (.zip) if it has been collected from a device?<\/p>\n<h3>Resolution:<\/h3>\n<p id=\"product-short-description\">The forensics package is a zip archive that contains the following information about device.<\/p>\n<div id=\"product-description\">\n<div>\u00a0<\/div>\n<div><strong>Note<\/strong>: The package is available for 14 days and contains the latest archive that has been collected from the device.<\/div>\n<p>Product and system information<\/p>\n<dl>\n<dt>basic\/product_info.txt<\/dt>\n<dd>Product version, license, update status, profile settings<\/dd>\n<dt>basic\/settings.txt<\/dt>\n<dd>Product settings<\/dd>\n<dt>basic\/systeminfo.log<\/dt>\n<dd>Operating system, hardware profile (memory and disk usage)<\/dd>\n<\/dl>\n<p>Information about firewall rules<\/p>\n<dl>\n<dt>firewall\/all_profiles.log<\/dt>\n<dd>Firewall profiles<\/dd>\n<dt>firewall\/all_rules.log<\/dt>\n<dd>Firewall rules<\/dd>\n<dt>firewall\/wfp_filters.log<\/dt>\n<dd>Firewall filters<\/dd>\n<\/dl>\n<p>Windows Group Policy settings<\/p>\n<dl>\n<dt>gpo\/gpo_computer.log<\/dt>\n<dd>Computer-level Group Policy settings<\/dd>\n<dt>gpo\/gpo_user.log<\/dt>\n<dd>User-level Group Policy settings<\/dd>\n<\/dl>\n<p>Network status<\/p>\n<dl>\n<dt>network\/ipconfig.log<\/dt>\n<dd>Network interface configuration values<\/dd>\n<dt>network\/netstart.log<\/dt>\n<dd>Started windows services<\/dd>\n<dt>network\/netstat.log<\/dt>\n<dd>Open network connections<\/dd>\n<dt>network\/netuse.log<\/dt>\n<dd>All network connections<\/dd>\n<dt>network\/nic.log<\/dt>\n<dd>Network card information from Windows Registry<\/dd>\n<dt>network\/nslookup.log<\/dt>\n<dd>Connectivity check (nslookup query) to WithSecure<\/dd>\n<dt>network\/ping_download_sp.log<\/dt>\n<dd>Connectivity check (ping command) to WithSecure<\/dd>\n<dt>network\/ping.log<\/dt>\n<dd>Connectivity check (ping command) to WithSecure<\/dd>\n<dt>network\/route.log<\/dt>\n<dd>IP routing tables<\/dd>\n<\/dl>\n<p>Windows properties and logs<\/p>\n<dl>\n<dt>win\/apiset_list.log<\/dt>\n<dd>C runtime dynamic libraries<\/dd>\n<dt>win\/drivers_active.log<\/dt>\n<dd>Active drivers<\/dd>\n<dt>win\/drivers_inactive.log<\/dt>\n<dd>Inactive drivers<\/dd>\n<dt>win\/hosts<\/dt>\n<dd>Hosts file<\/dd>\n<dt>win\/msucrt_list.log<\/dt>\n<dd>C runtime dynamic libraries<\/dd>\n<dt>win\/msvcrt_list.log<\/dt>\n<dd>C runtime dynamic libraries<\/dd>\n<dt>win\/process_list.txt<\/dt>\n<dd>List of running processes<\/dd>\n<dt>win\/scheduled_tasks.log<\/dt>\n<dd>Scheduled tasks<\/dd>\n<dt>win\/set.log<\/dt>\n<dd>Set environment variables<\/dd>\n<dt>win\/software.log<\/dt>\n<dd>Installed software<\/dd>\n<dt>win\/win.ini<\/dt>\n<dd>Basic windows settings<\/dd>\n<dt>win\/windowsupdates.txt<\/dt>\n<dd>Installed windows updates<\/dd>\n<dt>win\/eventlog<\/dt>\n<dd>Windows event logs<\/dd>\n<dt>win\/iexplore<\/dt>\n<dd>Internet settings from registry<\/dd>\n<dt>win\/registry<\/dt>\n<dd>Selected registry settings<\/dd>\n<\/dl>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>What log files are includes in the Elements Endpoint Detection and Response forensics package archive (.zip)?<\/p>\n","protected":false},"template":"","support_article_product":[100],"class_list":["post-8929","support_article","type-support_article","status-publish","hentry"],"acf":{"source_foreign_id":"000006896","source_version":1,"source_system":"salesforce","source_date_updated":"2026-10-19 15:52:43","import_hash":"37e5de638c14cb089da6de35ea8010541ce3bece","vanilla_article_id":"","vanilla_url":"","vanilla_kb_id":"","vanilla_category_id":"","machine_translated":false,"reactions_helpful_yes":"","reactions_helpful_no":""},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/support_article\/8929","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/support_article"}],"about":[{"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/types\/support_article"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/media?parent=8929"}],"wp:term":[{"taxonomy":"support_article_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/support_article_product?post=8929"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}