Local-first by design

There is no automatic Malware INFO cloud-analysis upload pipeline in the current architecture. Evidence stays local unless the user deliberately exports or shares it. Network features remain explicit: public feeds and updates retrieve data; licensed connectors contact the configured provider; VirusTotal lookup sends the selected indicator; a complete file is sent only after the user explicitly chooses Upload to VirusTotal and confirms. Memory evidence can contain secrets, so local storage still requires access, retention, and sharing controls.

Stop active collection cleanly, use the product's report/export action, retain the manifest and SHA-256 inventory, and work from a copy. Record case ID, source computer, target PID and creation time, collection mode, UTC start/stop, analyst, product version, and any source gaps or AV actions. Transfer only through an organization-approved evidence channel and remember that a report, dump, or archive may itself trigger AV because it contains malicious material.