A consolidated dashboard showing all data about a single endpoint -- hardware, software, patches, performance, security -- in one screen. The starting point for most investigations.

A shared collaborative environment where team members combine multi-endpoint data, add annotations, build evidence chains, and track investigation progress from triage to resolution.

A real-time, persistent connection to a specific endpoint for live data collection, remote management actions (killing processes, restarting services), and file operations.

A backend data layer storing historical endpoint data. Enables Investigate to display cached info for offline endpoints and show historical timelines of changes and events.

Client Extensions specific to Investigate that run on endpoints, enabling advanced data collection -- process monitoring, network connection tracking, file system event recording.

Threat Response = security investigations (malware, IOCs, detection rules, YARA signatures).

Investigate = IT operations investigations (performance, app failures, config problems, UX issues).

Both can view processes, network connections, and file data. They share the same TDS data layer. Use Threat Response for security incidents, Investigate for operational issues. Many orgs deploy both and collaborate across teams.