Chapter 6 — Endpoint telemetry
Lesson map
Lesson 06 published. Map, example, EX021.
flowchart TD
N0["Learning outcomes"]
N1["6.1 Endpoint agents"]
N2["6.2 Process events"]
N3["6.3 Account events"]
N4["6.4 Confirming compromise"]
N5["6.5 Isolation"]
N6["6.6 Health of agents"]
N7["Timeline building"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX021"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["6.1 Endpoint agents"]
N2["6.2 Process events"]
N3["6.3 Account events"]
N4["6.4 Confirming compromise"]
N5["6.5 Isolation"]
N6["6.6 Health of agents"]
N7["Timeline building"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX021"]
[Learning outcomes]
|
v
[6.1 Endpoint agents]
|
v
[6.2 Process events]
|
v
[6.3 Account events]
|
v
[6.4 Confirming compromise]
|
v
[6.5 Isolation]
|
v
[6.6 Health of agents]
|
v
[Timeline building]
|
v
[Worked example] --> [Exercise EX021]
Learning outcomes
You will (1) describe what endpoint agents record; (2) read process and account events; (3) use endpoint data to confirm or rule out compromise; (4) explain isolation as a containment option.
6.1 Endpoint agents
Endpoint detection and response (EDR) agents on laptops and servers record processes started, files changed, network connections and account changes, and can isolate a machine from the network on command. At Northgate the agents answer questions the portal log cannot, such as what ran on a PC after a click. In the second proxy case, the agent on the planning-office PC showed no new processes after the blocked download, which was enough to close it. Isolation is the agent's strongest action, so it needs the right authority and a recorded reason.
6.2 Process events
A process event shows which program ran, who ran it, what started it and the command line. Unusual parents, such as a word processor starting a command shell, are worth a look. For the finance PC that visited invoice-portal.example, Carlos would look for processes started by the browser shortly after the visit. A browser starting a script interpreter would be worth a closer look, while a browser opening a new tab is normal. The parent process and the command line are what separate those two cases.
6.3 Account events
Windows records account creation, group changes and logons with event IDs; the SIEM labels them so analysts need not memorise numbers. When Carlos checked the payroll admin in A2, the SIEM showed the account creation and the group change by label rather than by number. He could then match the creator and time against the approved change ticket. Labels also reduce mistakes when analysts move between Windows, the portal and other systems. The SIEM keeps the original event ID alongside its label for anyone checking raw logs.
6.4 Confirming compromise
For the parks01 case, Carlos checks the remote-access portal session: after logging in, parks01 opened the council's internal file share and listed folders for 6 minutes, then disconnected. No files were downloaded according to the share's audit log. The six minutes of folder listing fit the timeline: logon at 09:09, browsing ends at 09:15. The share's audit log showing no downloads is what keeps INC-0417 at minor severity, with one account and no data taken. Carlos still records that listing folders revealed their names to the outsider.
6.5 Isolation
Isolating cuts a machine off from the network except from the EDR console. It stops spread but also stops the user working, so it needs the right authority and a reason. For parks01, isolation was not needed, because the depot tablet was idle and not involved. Disabling the account stopped the outsider's access without stopping any device. Under the playbook, isolating a server would need the IT manager, so Carlos considers the smaller action first and records why isolation was unnecessary.
6.6 Health of agents
Missing agents mean missing data. Northgate's console lists PCs whose agents have not reported in 24 hours; IT fixes them weekly. A PC without a working agent is invisible to the SOC, so an attacker there would leave no endpoint trace. The 24-hour list turns this into a weekly task for IT. The same idea appears later at server level, when Carlos finds 18 servers not sending logs during the maturity assessment. Carlos checks the list when a case involves a PC, because a silent agent changes what the absence of evidence means.
Timeline building
Carlos lists every event in time order across portal, share and EDR, which makes gaps and links obvious to reviewers.
Worked example
Carlos finds the gardeners' shared tablet did not log in at 09:09; it was in the depot, idle. The session came only through the portal from 203.0.113.80. This confirms the logon was not a gardener, so the account is disabled and the case becomes an incident.
Synthetic case. Sessions and events are synthetic.
Errors and limits
EDR records what the agent can see; it misses machines without agents and actions on network devices.
Exercises
- EX021 — EDR records. List four kinds of event an EDR records. Rubric: 3 = processes, files, network, accounts; 2 = three; 1 = one; 0 = none.
- EX022 — Suspicious parent. Give an example of an unusual parent process. Rubric: 3 = word processor starting a shell; 2 = partial; 1 = vague; 0 = none.
- EX023 — parks01 activity. What did parks01 do after logging in? Rubric: 3 = listed file share folders 6 min; no downloads; 2 = partial; 1 = vague; 0 = none.
- EX024 — Isolation trade-off. What is the trade-off of isolating a machine? Rubric: 3 = stops spread but stops user working; needs authority; 2 = partial; 1 = vague; 0 = none.
Synthesis
Endpoint and access data confirm or rule out compromise; isolation is powerful and needs authority.
Continue studying — chapter 06 of 18
← Chapter 05 (draft) · Course chapter index · Chapter 07 (draft) →