SRA research

automated continuous collection and transmission of real-time data from across an organizations IT infrastrcuture

Endpoint Detection and Response a cybersecurity technology that continuously monitors end devices and provides deep level inspection

It's dependent on the sensors, configuration and supported events

Antivirus provides static based signature dection while an EDR continuously monitors endpoint behaviors and uses behavioral, machine learning, and anomaly detection to track patterns

They are deployed on endpoints and send info like timestamps, hostnames, current process, parent process , cmmand line info

Agent: Monitors actiity and collects even information
EDR Backend: Receives, telemetry, correlates events to form a story and perform threat analytrics to determine if a sequence is suspicious
EDR Console : Console presents the findings

It means that the system connects related events together to form a detection alert.

The SOC analyst needs to acknowledge the alert and prioritize it.
EDR will often present the detection event with a CVSS score

Process Executions, Network connections, command line activity, file and folder modifcations registry modications

built in hierarchical database that store configurations settings

hardware and software settings

Behavioral, Anamoly, Mitre Attack Mapping, Machine Learning

Isolate Host, Remote Access into it, Terminate the process

It provides a centralized solution to aggregating logs from multiple sources, correlating them, detecting malicious activies , and presenting them in a consistent format

Windows Sysmon, Linux var/log, Web Servers, EDR consoles,

Endpoint + SIEM agent -> TLS transport -> SIEM backend -> API -> SIEM Dashboard

Fine tuning the detection rule

It works well with ingesting Network Hardware logs because routers, switches, and firewalls don't use software agent

UDP/514