Exterro Forensic Agent
Agentic interface on forensic analysis of live endpoints
- Category
- CRM
- Registry category
- Cybersecurity & IT
- Vendor
- Exterro, Inc.
- Location
- Orem, Utah 84097, United States of America
- Reviews
- This marketplace has no ratings
- Listed on
- Google Cloud Marketplace
- Pricing
- 1 plan listed
Each fact carries one Provenance score: the average of its Disclosure and Evidence scores, the same rule the page uses for the overall score. Click any score to see the math behind it.
Vendor Provenance
Who actually operates this agent.
Build Provenance
What the agent is built on.
Reach Provenance
How the agent is distributed and adopted.
Data Provenance
What the vendor discloses about data handling.
Compliance Provenance
What standards the vendor meets, and who verified them.
What the publisher says
Exterro FTK Endpoint is a remote digital-forensics and incident-response platform that lets an AI client investigate live Windows endpoints through the Model Context Protocol.
It runs in three tiers: a stateless MCP server exposing the tool surface, an Agent Hub owning the WebSocket connections, and an endpoint agent installed as a Windows service, with Redis routing between them.
The MCP server registers 76 tools spanning host state, filesystem, event logs, registry, browser artefacts, memory, and forensic artefact parsing.
Show the rest of the publisher’s description (7 more lines)
Filesystem queries are answered from a DuckDB-backed NTFS index built by parsing $MFT and kept current from the USN journal, so a multi-million-file volume responds in milliseconds instead of by walking the disk.
Forensic collectors cover prefetch, shellbags, USB history, persistence, shadow copies, $I30, thumbcache, SAM accounts, and PowerShell history.
Evidence collection streams AES-encrypted, segmented archives over the WebSocket into cloud or NAS storage, with resumable jobs and forensic-format output.
Analytics run as plugins behind a generic analyzer registry — mailbox, chat, fileshare, timeline, and a full-text content index — rather than as an ever-growing tool list.
Authentication is a self-hosted OAuth 2.0 and PKCE authorization server issuing per-user JWTs, with refresh rotation, per-user revocation, optional SAML SSO, and a tenant claim scoping every request to its own data plane.
It deploys to GCP, AWS, and Azure across Cloud Run, EKS, GKE, and Container Apps, with a Go implementation of the hub for fault isolation and multi-core throughput.
Clients include Claude Desktop, a first-party chat application, and a Google ADK agent on Vertex AI Agent Runtime fronted by Gemini Enterprise, each carrying the end user's own token so audit records stay attributable to a person.
Plans and pricing
1 plan listed
Linked repositories
Unknown
Unknown means this listing does not publish a repository. It is not a statement that the code is closed.
Publisher resources
Sources
- Marketplace listingGoogle Cloud Marketplace (opens in a new tab)
- Company recordOutside company data, matched on exterro.com
Reading the score
Disclosure · how many sources corroborate it
Evidence · what kind of evidence backs it
The SettleTop steps above are possible but not automated yet, so today they sit open and a perfect 10 is out of reach. Open information like firmographics and reach has fewer steps to climb, so it sits a little higher for the same visible evidence.
Information shown here reflects the best available information at the time of assessment and may be incomplete, outdated, or subject to change. It should be independently verified before being relied upon for any decision. SettleTop is not liable for any errors, omissions, or decisions made in reliance on this information.
Have information about this agent?
Send it to us for consideration
Spot something missing, wrong, or out of date? Share what you know. Every note reaches our team. It does not change the passport by itself: we review it first.