Reviewing entities and actions
When researching a security event, the contextual data around the endpoint, whether a laptop, server, or virtual machine, can be pivotal in quickly understanding the level of concern for a particular alert. Other logging, such as network, identity, or cloud, will also be critical, depending on the context of the alert. MDE provides you with granular details on devices in your environment, all the way down to process and network events. What you may not realize is that there are also details on related entities, such as files, domains, users, and IP addresses. These are all linked together so that you can easily pivot during investigations and allow you to quickly check for trends at organizational or even global levels. What follows is a simple breakdown of each entity and what information you have available to you. How to leverage these in investigations will be covered in Chapter 8, Establishing Security Operations.
Devices
Since we’re...
