Forensic replication to your Amazon S3 bucket

What is replicated

When Forensics is selected in the Amazon Replication Service, the forensic evidence for each new alert is copied to your bucket automatically. For each alert, Forcepoint writes three parts:

Evidence is written to your bucket in a readable format. Protecting it with your own encryption, access policies, and retention rules is your responsibility.

Only evidence for alerts created after forensic replication is enabled is copied. Evidence for earlier alerts stays in Forcepoint Cloud and remains available for download in the portal.

Folder structure

Forcepoint writes to the following locations in your bucket:

In your bucket, the forensics folder contains one subfolder for each alert as shown below:

The subfolder name matches the Alert id shown in the alert details in the portal as shown below:

Validation and health checks

When you activate the service, Forcepoint validates that it can write to your bucket. After that, it checks again every 6 hours by writing a test object to the byos-healthcheck folder. If a check fails, the Forensics Replication Status changes to Failed.

Automatic recovery

If evidence cannot be copied to your bucket, for example because the bucket policy was removed, the evidence is kept in Forcepoint Cloud and the copy is retried automatically every hour. After you correct the problem, the next retry copies the evidence to your bucket and the status returns to Running. You do not need to take any other action.

Retention of the Forcepoint copy

Forcepoint keeps its own copy of forensic evidence for 30 days by default. You can shorten this to between 1 and 30 days with the Forensic Data Retention Period setting. When the period ends, Forcepoint deletes its copy. The copy in your bucket is not affected.

After Forcepoint's copy is deleted, the alert is still displayed in the portal, but its evidence can no longer be downloaded there. In the alert details, hovering over Download Evidence displays Forensic was deleted. To access the evidence, open your bucket and go to the folder named with the alert's Alert id.

Stopping forensic replication

If you clear the Forensics check box, or disable the Replication Service toggle:

• New evidence is no longer copied to your bucket.
• Evidence that is already in your bucket is not removed.
• Copies that are in progress are completed.
• Your bucket configuration is kept. When you select Forensics again, or enable the toggle again, replication resumes without re-entering the bucket details.

Security