For Windows, Linux, macOS with no previously-installed agents (e.g., either free or commercial agents such as SCCM, JAMF, osquery, LimaCharlie, FireEye HX, Crowdstrike Falcon, et al), I would jump to either GRR or NBD. For Windows, there is an NBD-Server project that can attach either memory (via GRR/Rekall's winpmem) as well as disks to NBD server TCP ports. For Unix and Linux OSes, it's simply nbd-server, available as a package on most distributions (or you can compile it to a specific platform).
The client should probably be a Linux machine and be able to load the NBD driver and use the nbd-client from userspace with The SleuthKit and filesystem mount tools. I have used CAINE Linux as the NBD client as it contains all of the tools necessary (N.B., others prefer SIFT, or via GIFT). You can then use plaso to acquire artifacts. For a full list see the formats here -- https://github.com/log2timeline/plaso/wiki -- or check out the
--info flags for each of the plaso tools. One of the best ways to work cases and collaborate on timeline data is to use a tool such as Google Timesketch.
In a way, the above would be running forensics on it, but I still think it's the best way. If you want to run around networks for hunting operations, perhaps check out Kansa or PowerForensics, but both of these are Windows-specific due to their reliance on PowerShell. CrowdStrike also has a wonderful free, open-source software (FOSS) solution, Falcon Orchestrator, that is built for your purpose -- but again, only Windows-specific. The nicest thing about NBD, pmem, and plaso is that you only have to teach the concepts to your staff once and they apply equally-well to all platforms.