Evidence Collection
What is Evidence Collection?
Evidence collection is a type of integration that gathers artifacts from events and forwards them to a configured destination. This integration is valuable for investigations, legal or HR reporting, threat hunting, and validating policies where artifacts provide important context.
Usage
Although evidence collection can be attached to every event, it is intended for cases where artifacts are required. Where the artifacts are stored depends on the destination you choose.
With a client-owned destination (Amazon S3, Google Cloud Storage, or Azure Blob Storage), artifacts are collected and sent directly from the Keep Aware sensor API to your own bucket or container. Ownership of the destination ensures that critical information remains under your control. You configure retention and access through your cloud provider. Read access to artifacts can optionally be enabled by providing access keys in the Keep Aware portal. When enabled, artifacts appear in areas of the console such as event details.
With Keep Aware-managed encrypted storage, Keep Aware provides the storage and encrypts each artifact with a public key you generate. Only the matching private key can decrypt the evidence, and that key stays with you and is never sent to Keep Aware. Keep Aware retains only the ciphertext and can't read it. You load your private key in the console to view and download evidence. See Collecting Evidence with Keep Aware Encrypted Storage for setup.
Artifact types
- Screenshots: A screenshot of the tab or page where the event occurred.
- HTML DOM: The HTML Document Object Model of the page where the event occurred.
- Input data: User inputs such as copy/paste operations and field entries.
- Uploads: The contents of files the user uploaded.
Supported destinations
Evidence collection supports two models. You can send artifacts to a client-owned blob storage service, including Amazon S3, Google Cloud Storage (GCS), and Azure Blob Storage. You can also store artifacts in Keep Aware-managed encrypted storage, where only you hold the key that decrypts them.
Getting started
To begin configuring evidence collection, see one of the available setup guides:
Amazon S3 Evidence
Requirements
Azure Blob Storage Evidence
Send event artifacts to a blob container in your own Azure storage account. Keep Aware authenticates with a Microsoft Entra application that you consent to and grant access to your container, so no account keys or long-lived SAS tokens are ever shared or stored.
Google Cloud Storage Evidence
Requirements
Keep Aware Encrypted Evidence
Store event artifacts in Keep Aware-managed, per-tenant storage without standing up a bucket of your own. Every artifact is encrypted with a public key that you generate in your browser, so only the matching private key can decrypt it. You hold that private key, and it's never sent to Keep Aware. Keep Aware keeps only the encrypted copy and can't read it. Encrypted evidence is retained for 30 days, then automatically deleted.