Our core incident response tool Kraken can be used to collect host evidence from Windows machines for threat hunting and further analysis. Data included in the snapshot as well as output format can be specified depending on your needs.