Endpoint EDR Internals, Telemetry and Response Architecture — DedSec Project

Endpoint detection and response combines sensors, event collection, enrichment, behavioral analytics, response controls, and central management. This module explains the architecture so analysts can reason about what EDR can and cannot prove.

Learning objectives

By the end of this module you should be able to:

• Explain Sensor placement and connect it to a concrete trust boundary or security invariant.
• Explain Process lineage and connect it to a concrete trust boundary or security invariant.
• Explain Content vs metadata and connect it to a concrete trust boundary or security invariant.
• Explain Behavioral detections and connect it to a concrete trust boundary or security invariant.
• Explain Response actions and connect it to a concrete trust boundary or security invariant.
• Explain Tamper protection and connect it to a concrete trust boundary or security invariant.

Deep concepts

1. Sensor placement

Endpoint sensors may observe process creation, image loads, files, registry/configuration, network connections, authentication, scripts, kernel events, or security-provider telemetry. Coverage is platform/version dependent.

2. Process lineage

Parent/child trees are useful but imperfect: service managers, schedulers, shells, browsers, containers, and IPC can separate the logical initiator from the direct parent. Use multiple contextual fields.

3. Content vs metadata

Collecting hashes, paths, signer identity, command metadata, and behavior often provides value with lower privacy cost than indiscriminate content capture. Define collection boundaries explicitly.

4. Behavioral detections

Strong detections identify a meaningful behavior chain or invariant violation rather than a single tool name. Tool-independent logic survives renaming and benign administrative overlap better.

5. Response actions

Isolation, process termination, file quarantine, credential/session revocation, and remote collection have different risks. Response playbooks need approval thresholds and recovery paths.

6. Tamper protection

Security agents require privileged components and therefore need update integrity, configuration protection, service health monitoring, and clear behavior when the sensor stops reporting.

7. Cloud analytics

Central platforms correlate endpoint data with identity, email, cloud, and network signals. Preserve source timestamps, device identity, tenant, and schema version so correlation remains defensible.

8. Validation

Test detections with benign simulations that exercise the intended telemetry, and confirm both positive evidence and expected non-events. Avoid assuming a green dashboard means complete visibility.

Authorized exercises

Exercise 1 — Design an endpoint event schema for process start that includes identity, parent, signer/hash, session, container context, and correlation ID

Design an endpoint event schema for process start that includes identity, parent, signer/hash, session, container context, and correlation ID.

Exercise 2 — Create a detection test for a harmless unusual child-process pattern using local scripts; document false-positive conditions

Create a detection test for a harmless unusual child-process pattern using local scripts; document false-positive conditions.

Exercise 3 — Write a response decision matrix for isolate host vs revoke session vs terminate process vs observe only

Write a response decision matrix for isolate host vs revoke session vs terminate process vs observe only.

Knowledge checks

1. Explain the most important trust boundary in Endpoint EDR Internals, Telemetry and Response Architecture without naming a security tool.
2. Give one example where cryptographic or authentication success still does not imply authorization success.
3. Describe one stale-state or replay condition relevant to this module.
4. Identify one telemetry source that can support a strong conclusion and one blind spot it still leaves.
5. Explain how you would turn a discovered weakness into a regression test rather than a one-time finding.

Guided study workflow