SOC Analyst · Lesson 5 of 8
Reading endpoint evidence
Endpoint detection and response tools, or EDR, report activity on devices. A process name alone rarely explains intent; its relationships and context matter.
Look at the relationship
Fictional endpoint observation on a finance laptop.
- Document viewer
Parent process opens a document.
- Command interpreter
A child process starts with command details to review.
- Related activity
Check associated file and network events, user context, and timing.
Read the visualIs a familiar process name enough to close the alert?
No. Check its parent, command, owner, and expected task before judging the activity.
Follow relationships
Look at which process started another, the command details, user context, and associated file or network events.
Check expected work
An administration script can be legitimate or misused. Compare timing and ownership with an approved change or task.
Preserve before acting
Retain relevant event IDs and context. Device isolation can interrupt work and should follow the response process.
Put it in context
A document viewer starts a command interpreter on a finance laptop. That unusual relationship deserves investigation; the process name by itself is not a verdict.
Interpret device activity as a sequence with context.
Read the sources
Make it stick.
Try one short question to check your understanding and save this lesson to your progress.