TensorGuard Components

Client Support

We are constantly increasing our supported platforms. Please submit a request if there is a platform or forensic source you’d like to see integrated.

Supported Today: ✅ | Support Planned: ❌ | Support Not Applicable: 🔵

The TensorGuard Console

Platforms	Chrome*	Firefox	Windows	Linux	MacOS
Case, Account, & Device Management	✅	❌	✅	✅	❌‡
Report Triggering	✅	❌	✅	✅	❌‡
Report Viewing	✅	❌	✅	✅	❌‡
High Performance Report Viewing†	🔵	🔵	✅	✅	❌‡

*Via web access, we only officially support the latest stable version of Chromium-based browsers.

†Multithreading support, along with 32-bit RAM limits, causes reduced performance in Chrome versus native applications. We recommend using the native apps for high performance report viewing.

‡ We are working to support MacOS in the near future.

Web

Access from Chrome

Downloads

Windows Linux

The TensorGuard Forensic Collector

Platforms	Windows	Linux	MacOS
RecentLnk	✅	🔵	🔵
AutomaticDestination	✅	🔵	🔵
CustomDestination	✅	🔵	🔵
ShellBag	✅	🔵	🔵
Evtx	✅	🔵	🔵
AmCache	✅	🔵	🔵
ShimCache	✅	🔵	🔵
SRUM	✅	🔵	🔵
PsHistory	✅	🔵	🔵
ProfileList	✅	🔵	🔵
Mft	✅	🔵	🔵
Chrome-based Browser	✅	✅	✅
Firefox-based Browser	✅	✅	✅
Safari Browser	🔵	🔵	✅

Downloads

Windows Linux MacOS

Basic Usage

The TensorGuard workflow is designed to be logical and scalable, centering around the concept of a Case as the primary unit of investigation. The diagram below illustrates the relationship between the core components of the platform, from user organization to final report generation.

The Workflow

The central organizing principle in TensorGuard is the Case. Within your organization’s account, a Case serves as the container for a specific investigation, incident, or compliance check. You begin by enrolling one or more target Devices into a Case. From there, you can trigger an on-demand forensic collection using the TensorGuard Forensic Collector. For proactive security, Schedules can be configured to automate this collection and analysis process on a recurring basis across any group of systems. The platform also supports the manual submission of forensic collections into a Case for offline or air-gapped devices.

Once a collection is completed and uploaded to the TensorGuard cloud, our analysis engine processes the raw data to generate a comprehensive Report. Every report provides direct access to the raw forensic evidence for deep-dive analysis. Based on your configuration, the report is enriched with layers of intelligence. These include high-level Alerts for positive or negative findings, and for reports with AI analysis enabled, a plain-language Executive Summary with evidence citations and a detailed Indicator of Compromise (IoC) Timeline. These tiered results allow analysts of all skill levels to jumpstart their understanding of the security posture of a device and take appropriate action.

TensorGuard Workflow and Components Overview

Organization:

• Users
• Cases
  • Assigned Users
  • Schedules
  • Integrations
  • Devices
    • Device reports
  • Manual Reports

Reports:

• Alerts (Positive/Negative Findings)
• Executive Summary w/ Evidence Citations (with AI analysis enabled)
• IoC Timeline (with AI analysis enabled)
• Raw Forensic Evidence