Lesson 2: Detection, Telemetry, Activity Recorder, and IOC Search

Review a realistic scenario involving endpoint telemetry and activity-recorder concepts.
Create or validate a configuration plan covering suspicious activity, detections, incidents, and event context and indicator-of-compromise search and query construction.
Use logs, reports, or test results to confirm search validation and telemetry troubleshooting.

Explain the purpose and operational impact of endpoint telemetry and activity-recorder concepts.
Apply practical controls for suspicious activity, detections, incidents, and event context and indicator-of-compromise search and query construction.
Validate and troubleshoot search validation and telemetry troubleshooting using an evidence-based workflow.

Lesson Overview