Overview
Telemetry — the rich endpoint data EDR records — is the foundation of endpoint detection, investigation, and hunting. This capstone lesson covers it and consolidates endpoint detection.
Learning objectives
- Explain EDR telemetry and its uses.
- Connect telemetry to detection, investigation, and hunting.
- Consolidate the endpoint-detection module.
Core concept
Telemetry is the detailed activity data an EDR continuously records from endpoints: process events (launches, parent-child, command lines), file operations, network connections, registry/system changes, authentication/logon events, and more. This rich, continuous record is the foundation of everything EDR enables: detection (behavioral analysis runs on telemetry), investigation (process trees and timelines are reconstructed from telemetry), and threat hunting (proactively querying telemetry for hidden threats — module 16). The breadth and retention of telemetry determine how much can be detected and investigated — like log sources at the network/log level, endpoint telemetry defines endpoint visibility. Comprehensive endpoint telemetry, retained adequately, is what makes deep endpoint detection and response possible.
How it works
EDR agents record telemetry — a continuous stream of endpoint activity: process creation (with lineage and command-line arguments), file reads/writes/deletes, network connections (destinations, ports), registry/configuration changes, module/driver loads, and logon events. This data streams to the central platform, where it drives: behavioral detection (module 8 — rules/analytics over telemetry flag suspicious behavior), investigation (reconstructing the process tree, timeline, and scope of an incident from the recorded telemetry — even for activity before the alert, given retention), and threat hunting (module 16 — analysts query telemetry for indicators/behaviors that no alert fired on, proactively finding hidden threats). Telemetry's breadth (what's captured) determines detection/investigation coverage — gaps are blind spots — and its retention determines how far back investigations and hunts can reach (echoing log retention, module 4). Adequate, comprehensive telemetry is thus foundational to EDR's value. This consolidates endpoint detection: EDR provides the platform, telemetry is its data foundation, process trees and persistence indicators are how analysts read that telemetry to reconstruct and detect attacks, and containment is the response — together giving the SOC deep endpoint-layer detection, investigation, and response, complementing network (IDS) and log/SIEM analysis in defense in depth.
Practical example
Across the endpoint-detection workflow, telemetry underpins everything. On a compromised host: EDR behavioral detection fired on telemetry (a suspicious process behavior); the analyst investigated by reconstructing the process tree and timeline entirely from recorded telemetry, tracing the attack chain and finding persistence indicators; because telemetry was retained, they could see activity from before the alert to find the entry point; they contained the host via EDR isolation. Later, a threat hunt queried the same telemetry across all endpoints for the attack's indicators, finding another affected host no alert had flagged. The rich, retained telemetry made detection, investigation, containment, and hunting all possible — consolidating the whole module.
Cybersecurity relevance
Telemetry is the data foundation of endpoint security: the rich, continuous endpoint activity EDR records (process, file, network, registry/system, logon events) drives detection (behavioral analytics), investigation (process trees and timelines reconstructed from it — reaching back given retention), and proactive threat hunting (module 16). Its breadth determines detection/investigation coverage (gaps are blind spots) and its retention how far back analysis can reach (echoing log retention). This consolidates endpoint detection — EDR (platform), telemetry (data), process trees and persistence indicators (reading it), and containment (response) — giving the SOC deep endpoint-layer capability that complements network (IDS) and log/SIEM analysis in defense in depth. Comprehensive, retained telemetry is what makes modern endpoint detection and response possible.
Common mistakes
- Insufficient telemetry breadth (blind spots) or retention (can't investigate/hunt back in time).
- Treating telemetry as only for alerts rather than also for investigation and proactive hunting.
- Not leveraging retained telemetry to find an incident's pre-alert entry point or other affected hosts.
Key takeaways
- Telemetry is the detailed endpoint activity EDR continuously records (process, file, network, registry/system, logon events) — the foundation of detection, investigation, and hunting.
- Its breadth determines coverage (gaps are blind spots) and its retention how far back analysis reaches (echoing log retention); comprehensive, retained telemetry is foundational.
- This consolidates endpoint detection: EDR (platform) + telemetry (data) + process trees/persistence indicators (reading it) + containment (response) — deep endpoint capability within defense in depth.
Check your understanding
- What does EDR telemetry include, and how does it drive detection, investigation, and hunting?
- How do telemetry breadth and retention affect endpoint detection and investigation?