Typical telemetry
- Process creation and parent-child relationships.
- Command lines.
- File creation or modification.
- User and session context.
- Network connections.
- Security-relevant changes and detections.
RR CYBERLAB • Endpoint Security
EDR Fundamentals
Understand endpoint detection and response telemetry and how analysts use it during investigations.
QUICK READ
EDR focuses on endpoint activity such as processes, files, users and network connections. Its value comes from detailed host context and investigation pivots.
Use this page after the daily quiz: learn the concept first, then follow the investigation workflow and examples.
Investigation workflow
- Start from the triggering process or alert.
- Review process ancestry and descendants.
- Check command line and file activity.
- Pivot to network destinations.
- Look for related activity on the same user or host.
Example
A suspicious document launches a scripting interpreter, which creates a file and then makes an outbound connection. EDR can provide the process tree and host evidence needed to build the timeline.Common mistakes
- Looking only at the alert title.
- Ignoring process ancestry.
- Treating every administrative tool as malicious.
Daily quiz hook
Which EDR evidence is especially useful for understanding how a suspicious process started: its parent-child process relationship or only its filename?
Quiz flow: introduce this topic briefly on social media, ask the question, reveal the answer, then send learners here for the detailed investigation.
Analyst practice note
Endpoint detection and response is useful when events retain relationships: process ancestry, user, file changes, persistence, network activity, and sensor health. An alert is one analytic result; the underlying timeline is what lets an investigator test the explanation.
Follow one process from parent to child and compare its behavior with the host’s role. Missing telemetry can reflect sensor coverage or policy as well as attacker evasion, so validate collection health before concluding that an event did not occur.
Continue practicing: open a fictional mission and test your reasoning against the simulated evidence.