EDR Event Streams

## The sensor records before it decides An EDR agent — CrowdStrike Falcon, SentinelOne, Cortex XDR and their peers — does two jobs inside one process on the host. It **records**, continuously, on every covered machine, whether anything interesting is happening or not. And it **convicts**: behavioural logic runs against what was just recorded and raises an alert when a pattern crosses a threshold. Analysts who meet the product only through its alert queue often assume the second job is the whole product. It is not, and the gap between the two is exactly the space a threat hunter works in. ## What is in the stream The recorded stream is a set of typed events. Every one carries a timestamp, the host, and — the property that makes the whole thing useful — the process that caused it. | Event class | What it carries | What it proves | |---|---|---| | Process execution | image path, full command line, recorded parent, user, hashes | a process started with those arguments | | Module / shared-object load | the object mapped, and the process that mapped it | code was mapped into that address space | | File write or create | the path written, and the writing process | that process wrote to that path | | Network connection | local and remote endpoints, direction, owning process | a socket was opened to that address | On Windows the same sensor also records registry writes; depending on sensor and configuration you may additionally get script content, DNS requests or authentication events. On a Linux server fleet, the four classes above are the backbone, and "module load" means a shared object mapped into a running process. Because each event names its process, and each process names its recorded parent, the console can draw **lineage** — a graph of who spawned whom, with each node's command line — rather than a flat list of lines. Lineage is the single feature that most distinguishes an EDR stream from generic host logging. ## An alert is one query result Detection logic is evaluated over this stream. An alert asserts: *these recorded events matched this rule*. It is not an extra, independent observation of the host. Two directions follow, and interviewers listen for both: - An alert proves a **detection fired**. It does not prove that something malicious happened. A benign true positive — the behaviour really occurred and really was what the rule described, but it was an administrator's own scripted enumeration — matches the rule exactly and is still not an intrusion. - No alert proves that **no rule convicted anything**. It does not prove nothing ran. The behaviour may have been recorded and simply never matched by any rule; it may never have been recorded, because the sensor does not observe purely in-memory work; or it may have happened before the window the console still holds. So "we had no alerts on that box" is a statement about the detection content, not about the box. ## Why hunting is possible Because the stream exists independently of the rules, you can go and ask it questions the rules never asked. A hunt is a hypothesis — *an intruder who got into this fleet would have had to enumerate the accounts and reach out somewhere* — turned into queries over process executions, module loads and connection events, then triaged by hand. The output is a verdict reached with no alert behind it, and it is one of the few ways a SOC finds an intrusion that its own detection content missed. It also runs backwards: once you know one host and one time, lineage lets you walk the tree up to whatever spawned the thing you found and down to everything it spawned, over the entire retained window, on every host at once. ## What bounds the search Two things. First, **the sensor's blind area**: activity performed entirely inside an already-running process, that never execs a child, never maps a new object and never opens a socket, produces no event to search. Second, **retention**. The raw events do not live on the host — the agent buffers briefly for offline machines and ships everything to the vendor's platform — so the searchable history is whatever the console's tier keeps, typically a short hot window with a longer, harder-to-reach tier behind it. A hunter who does not state the window they searched has not finished the answer. ## What to say in an interview Say that the sensor is a recorder first and a detector second; name the four event classes and the process attribution that binds them; and be crisp about direction — an alert proves a rule fired, and no alert proves nothing except that no rule fired.