EDR, SOAR & Defensive Tooling Classes

A UEBA risk score is the sum of weighted reasons that fired on one account in a time window, measured against a learned baseline. It orders the queue; it is not a probability that the user is malicious.

A link that is harmless when the message arrives and armed hours later. Delivery-time scanning judges the destination as it was at delivery; rewriting routes every click through the gateway, so the destination is judged again at click time.

Only two narrow things: the file chains to a trusted publisher certificate and is unmodified since signing, and no rule in that one product matched the telemetry the agent collected. Neither claim is about the process's behaviour.

Hash and YARA matching test content against known-bad patterns. A signed, allow-listed archiver is legitimate content, so nothing matches. The malice lives in how the tool is driven, and only a behavioural chain can convict that.

The fidelity comes from the asset, not the rule. Nothing legitimate should ever touch an account no person or service uses, so a single interaction is abnormal by construction — no baseline, threshold or tuning required.

An EDR sensor records continuously, not only when it convicts. Process executions with full command lines and recorded parents, module loads, file writes and outbound connections are all in the stream, searchable whether or not any detection fired.

Network and storage appliances with vendor-locked operating systems, hypervisors such as ESXi, embedded and OT devices, and contractor or BYOD laptops you have no right to manage. No alert from them proves nothing: there is no sensor to fire one.

Isolation blocks the host's network traffic except the EDR agent's own channel to its console. The machine stays powered on, its processes keep running, and any credentials already stolen from it still work everywhere else.

Only that the EDR's API accepted the isolation request. The host is cut off once its agent checks in and applies the policy; an offline or dead agent leaves the request pending, so verify containment in the EDR's own host record.

Execution at the highest privilege on every enrolled host, through a signed agent that is already installed and already trusted. No malware to deliver, no persistence to plant, and the actions look like the SOC's own response work.

Yes, but preserve a copy and pull the click list first. Retraction removes copies still in tenant mailboxes; it cannot undo a click, reach copies taken outside the tenant, or stay unnoticed by the recipients.

Split the question into what the stream can still answer and what is gone. Search the retained window, query the host's present state for surviving artefacts, and record the pre-window period as no visibility rather than no activity. Never infer the earliest link.

The run log is a claim, not evidence: rebuild what landed from each target's audit trail. The artifact stayed published, so the path was never closed. Quarantine it manually, re-scope to its consumers, re-date containment.

An inline control sits in the path of the action and can stop it before the data moves. A SaaS API scanner sees files only after they are stored or shared, so it can remediate exposure but never prevent it.

Peer comparison collapses into self-comparison. With one member, every peer-relative reason only re-measures the user's own history, so ordinary role-specific work such as a quarter-end reporting spike scores as deviation and climbs the queue.

It proves the protection service received a request for that recipient's rewritten link at that time, and what verdict it applied. It does not prove a person clicked, that they reached the page, or that they typed anything into it.

Because all three decide on the same assumption: a signed client, a business-categorised destination and a valid session look like work. Their blind spots overlap instead of covering each other, so three benign verdicts add no independent evidence.

It must observe enough related events on one process tree to separate malice from administration. That evidence exists only once execution is underway, so conviction lands after files are already encrypted — which is why vendors ship rollback.

It proves something rendered the file and that host could reach the token service then. It names no person and proves no copying: the source address is usually your egress gateway, the user agent the renderer.

Consistency with its peers: an age band, naming convention, organisational unit, group memberships and description matching real service accounts, plus a service principal name pointing at a host that exists. Bare, brand-new objects get skipped.

Quite a lot, none of it on disk. Expect shared-object load events into the running process, a burst of sub-second child processes carrying full command lines, and outbound connection events attributed to that process — with no new binary and no file write anywhere.

It suppresses whatever the product ties to that path, usually on-access scanning and sometimes behavioural detection or collection too. An adversary who can read or guess the list stages tooling inside the excluded directory and runs it unscanned.

Exempt hosts where the automated cut-off hurts more than the intrusion it might stop: domain controllers, the certificate authority, trading-floor systems, jump hosts, the security tooling itself. The cost is human-speed containment on your most valuable hosts.

Because two later questions depend on it: separating your team's response actions from an intruder's, and telling an auditor who authorised destroying data on someone's machine. A shared login or a single automation service account collapses both into one anonymous actor.

Reason from the metadata: which indexed source matched and how much of it, the destination, the device and the user's history with that policy. Then ask the person entitled to read the content - the owner of the fingerprint index - to confirm it.

Because a UEBA score measures deviation from a learned normal, not maliciousness. A credential used from the usual country, at usual hours, against the systems that account always touches produces no deviation, and a flat score is evidence of nothing.

Do not count verdicts as votes. Restate each as a claim, its basis and the surface it observed, then keep only the verdicts whose surface covers the hypothesis. Two controls that never watched the behaviour are silent, not corroborating.

Rollback is a local undo. The Windows agent restores files on its own endpoint's volumes from Volume Shadow Copy snapshots plus its record of observed changes. A mapped drive is another machine's storage, so nothing there is in scope.

Change the placement, not the rule. Take the decoy out of the scanner's credentialed scope and the inventory crawler's discovery source so nothing legitimate reaches it. Suppressing the alert instead creates an exclusion an adversary can operate inside.