Reliably and Effectively Acquire Data from Remote Systems: A SANS First Look

Reliably and Effectively Acquire Data from Remote Systems: A SANS First Look, published by SANS Institute in September 2025, is a hands-on first look at Magnet Nexus, a cloud-native tool from Magnet Forensics designed to help digital forensics and incident response (DFIR) teams reliably collect and analyze data from remote endpoints. The review covers the platform's endpoint dashboard, data acquisition workflow, cloud-native architecture, and how it integrates with Magnet's Axiom Cyber desktop application.

Key findings:

• The Magnet Nexus endpoint dashboard lets investigators search for endpoints across an organization, check their status, and kick off a data collection scan from a single interface
• The collection creation workflow lets analysts filter to show only artifacts relevant to a specific operating system before starting a scan, rather than sifting through a full unfiltered catalog
• Magnet Nexus supports an extensive catalog of collectible artifacts, including RAM captures, documents, operating system data, and connected devices, selectable based on investigation needs
• The agent can run YARA scans directly on endpoints, using either a library of predefined rules or custom rules supplied by the investigator
• Collected case data is visible to the investigator who created the case and anyone the case is shared with, who can filter and tag artifacts as relevant without needing separate export steps
• As a cloud-native solution, Magnet Nexus requires only a browser to start collecting and analyzing evidence, removing the need to install and maintain compatible forensics software on local machines
• The cloud-based architecture supports dynamic scaling based on the task at hand and lets distributed response teams collaborate on the same case from anywhere in the world
• Magnet Nexus is designed to work alongside Axiom Cyber, Magnet's offline desktop application, for cases where data privacy, residency, or security requirements rule out a SaaS-based collection
• Axiom Cyber's artifact-first approach includes analytics features such as a Timeline, a Connections view, an IOC Insights Dashboard, MITRE ATT&CK framework TTP mapping, YARA rules, MFT parsing, Magnet Copilot, and Magnet.AI
• A single, lightweight hybrid Nexus Agent can be deployed once and used to support both Nexus (SaaS) and Axiom Cyber (on-prem) workflows, with all collections tracked and orchestrated in Nexus regardless of which platform performs the analysis, giving full auditability

The review's overall takeaway is that a cloud-native acquisition tool shifts investigator effort away from the mechanics of collecting remote data and toward analysis, which matters most for organizations with distributed or remote workforces where response teams need to collect from and collaborate across geographically dispersed endpoints quickly. This is a SANS First Look, a hands-on product review format rather than a survey; the assessment is based on direct testing of Magnet Nexus's endpoint dashboard, collection workflow, and artifact view.