A city IR playbook auto-collects prefetch, authentication logs, and browser history on suspected phishing hosts. What defensive automation practice is that?

A city IR playbook that auto-collects prefetch, authentication logs, and browser history on suspected phishing hosts is practicing automated prioritized artifact collection for civic IR. Prefetch shows recently launched binaries, authentication logs show who signed in and from where, and browser history shows the lure path the user followed. Automating that short list on phishing-class hosts gives municipal responders high-signal evidence immediately instead of waiting for analysts to invent an approach or manually searching afterward.

Automating prioritized full-disk image collection on suspected phishing hosts for civic IR is exhaustive imaging, not prioritized artifact collection; it captures the entire drive rather than the targeted prefetch, authentication logs, and browser history the playbook automates. Automating prioritized threat feed collection on suspected phishing hosts for civic IR gathers external intelligence context rather than collecting host artifacts, so it does not produce the prefetch, authentication logs, or browser history from the endpoint the playbook automates. Automating prioritized artifact collection on suspected phishing hosts for civic audit uses the same targeted collection mechanics but for the wrong purpose; it serves compliance review rather than the immediate civic IR response described.

Exam caveat: Prioritized collection focuses IR response on signal, not exhaustive data gathering. Define your phishing playbook's artifact list (prefetch, logs, browser state, MFT) and hardcode it into automation. Adjust for municipal asset types (e.g., clinic vs. parks workstations may have different artifact baselines).

Operational check: Document the target artifact list for phishing-class hosts (e.g., prefetch, auth log, browser cache, MFT entry); create an automated collection profile in EDR/MDE; test it on a clean endpoint to confirm artifacts are collected; and measure time-to-evidence for a test phishing scenario.