How to Use EDR Telemetry in DFIR: 3 Investigation Methods Compared
Brief
EDR telemetry is one of the fastest and most complete sources of evidence for intrusion investigations.
But what’s the best way to investigate with it?
This post covers the 3 most common ways SOC analysts and DFIR teams investigate using EDR data, breaks down the pros and cons, and provides quick, step-by-step how-tos for each method.
Let’s get to it…
Jump to a section
Top 3 Ways to Investigate Telemetry
Method 1: Use the EDR Console
Method 2: Import into Excel