What is an endpoint-security log?¶

An endpoint-security log contains selected device telemetry and product assessments from antivirus, EDR, host firewall or application-control tools. It is not a complete forensic history or definitive malware attribution.

Agent and policy define visibility¶

Telemetry can include processes, files, command lines, network connections, user sessions, detections, quarantine and remediation. Agent version, policy, connectivity and collection affect gaps and delay. A detection label is a product classification, and the named user may only be the logged-in account.

Preserve the process and response context¶

Identify product, agent, policy and whether the item is raw telemetry, detection, alert or analyst conclusion. Retain process trees, hashes, commands, network events and remediation history.

Correlate forensic, authentication and network evidence and use specialists for process ancestry or malware behaviour where necessary.