Do you use Mandiant's Redline (https://wwwfireeyecom/services/freeware/redlinehtml) for performing host investigation? Do you use Splunk for centralized log collection and monitoring? How about using these two tools together? The team behind the Splunk Forensic Investigator app (https://splunkbase