The Linux Command That's Quietly Saving (or Costing) SOC Teams Their Evidence

Three hours into a lateral-movement investigation, the process list on a compromised jump host shows something that shouldn't be there — and it's about to scroll off screen. There's no time to re-run the command later and hope the host still looks the same. If that output isn't captured right now, exactly as it appears, it's gone.

This is a gap a lot of incident response workflows quietly have: analysts see critical output live, react to it, and never actually preserve it. By the time someone writes the report, the "evidence" is a half-remembered terminal session.

There's a decades-old Unix command built for exactly this problem, and most people only use half its power.

tee reads from stdin and writes that same stream to stdout and to a file simultaneously — not sequentially, not as a fallback, both at once. That's a meaningfully different tool than command > file, which hides output from the screen entirely. During active triage, you need both: live visibility to make fast decisions, and a durable, unaltered copy to back up why you made them.

In the full writeup, I cover:

• The core mechanics of tee and why it beats plain redirection for evidence capture
• A real SOC scenario building a running incident case log with tee -a
• The full command reference — multi-file writes, sudo writes to protected paths, filtering with grep/wc/sort without losing raw output, capturing stderr
• The adversarial side: what unusual tee invocations look like in EDR telemetry
• Practical tips on hashing captured logs so they hold up as real evidence

If your IR process still relies on analysts manually copy-pasting terminal output after the fact, this closes a real gap.

Full guide: https://www.xpert4cyber.com/2026/09/linux-tee-command-soc-incident-response.html