Vanguard

Single self-contained binary bundling 28 incident-response use cases including triage, threat hunting, memory forensics, disk collection and remote operations, with automated timeline generation. Runs air-gapped and can orchestrate Velociraptor for large-scale endpoint collection.