Mandiant’s MIR appliance significantly accelerates the incident response process. Users must have a strong understanding of incident response to use the product to its fullest potential. MIR’s multiuser system allows investigators to collaborate on incidents, request more audits, and share notes. The true power of MIR is in its extensive audit and search capabilities, including file, disk, and physical memory acquisition; event log collection; registry analysis; rootkit hook detection; and services, tasks, and user account listings.”]
Source: https://www.darkreading.com/attacks-breaches/mandiant-appliance-accelerates-incident-response