Overview
Telemetry is the raw material of threat hunting — the logs and data recorded from endpoints, networks, and systems. This lesson covers the telemetry hunters rely on and why its quality determines what can be hunted.
Learning objectives
- Define telemetry in the hunting context.
- Identify the main telemetry sources used for hunting.
- Explain how telemetry availability and quality limit or enable hunts.
Core concept
Telemetry is the recorded data about activity across the environment — endpoint telemetry (process launches and trees, file and registry changes, EDR data from module 12), network telemetry (connections, flow data, DNS, IDS logs from module 11), authentication logs (module 10), and application/system logs (module 4). Threat hunting is entirely dependent on telemetry: a hunter can only find evidence of a behavior if the data recording that behavior exists and is accessible. Testing a hypothesis (previous lesson) starts with identifying which telemetry would show the hypothesized behavior. This makes telemetry coverage, retention, and quality decisive — gaps mean blind spots where attacker activity leaves no trace to find. Hunting therefore both consumes telemetry and, when it finds gaps, drives improvements to logging coverage.
How it works
For a given hypothesis, the hunter maps the behavior to the telemetry that would record it: persistence via scheduled tasks → endpoint task-creation logs; lateral movement → authentication logs and network connections; data staging/exfiltration → file activity and network flow/DNS data. They confirm that telemetry is actually collected, retained long enough to cover the hunt window, and rich enough (right fields, parsed correctly — module 5) to answer the question. Endpoint telemetry (EDR) provides deep host visibility (process trees, module 12); network telemetry (flow, DNS, IDS) shows communication and movement; auth logs reveal credential use. Where telemetry is missing (a source not logged, or retention too short), the hunt is limited — and that gap itself becomes a finding, prompting expanded logging so future hunts and detections can cover it. Well-instrumented environments enable far more effective hunting than sparsely logged ones.
Practical example
Testing the persistence hypothesis ("scheduled tasks created outside change windows"), the hunter identifies the required telemetry: endpoint logs that record scheduled-task creation events with the task name, creator, and timestamp. They verify the environment's EDR collects these events and retains them long enough to cover the period of interest. For the lateral-movement part of the intel, they also pull authentication logs and network connection telemetry. During this, they discover one server segment is not forwarding endpoint telemetry — a coverage gap that means the hunt is blind there. That gap becomes a concrete finding: the SOC extends logging to that segment. With the right telemetry confirmed available, the hunter can proceed to baseline and query it; without it, the hunt could not test the hypothesis at all.
Cybersecurity relevance
Telemetry is the foundation of hunting — hunts can only find what the data records, so coverage, retention, and quality directly determine the SOC's ability to detect evaded threats. Understanding which sources reveal which behaviors (endpoint for host activity, network for communication/movement, auth for credential use) lets hunters test hypotheses efficiently and recognize blind spots. Hunting also surfaces telemetry gaps that, once closed, strengthen both future hunts and automated detection. Building on the logging, SIEM, EDR, and network-data modules, telemetry is what turns a hypothesis into an answerable question.
Common mistakes
- Assuming telemetry exists for a behavior without confirming it is collected and retained.
- Ignoring retention limits, hunting over a window the data no longer covers.
- Overlooking telemetry gaps as findings — a blind spot is itself something to fix, not just an inconvenience.
Key takeaways
- Telemetry — endpoint, network, authentication, and system logs — is the raw material every hunt depends on.
- A hunter maps each hypothesis to the telemetry that would record the behavior, then confirms it is collected, retained, and rich enough.
- Coverage, retention, and quality determine what can be hunted; gaps are blind spots and become findings that drive better logging.
Check your understanding
- What telemetry sources reveal endpoint, network, and credential-use behaviors respectively?
- Why is confirming telemetry availability and retention a necessary first step in a hunt?