Resources • Webinars
Tidying up your nest: Validating ATT&CK technique coverage using EDR telemetry
Endpoint Detection & Response (EDR) telemetry offers defenders a powerful tool for catching threats. However, understanding how to validate ATT&CK technique coverage using EDR telemetry can be a challenge.
On-Demand
50 mins.
Virtual
Endpoint Detection & Response (EDR) telemetry offers defenders a powerful tool for catching threats. However, understanding how to validate ATT&CK technique coverage using EDR telemetry can be a challenge.
As Detection Validation Engineers at a Managed Detection & Response (MDR) provider that ingests nearly a petabyte of endpoint telemetry every day, we’re in the unique and necessary position to analyze EDR telemetry at scale and validate its efficacy against common adversary tradecraft.
After providing a brief introduction to EDR telemetry, we’ll discuss how to break ATT&CK techniques down to individual data components, perform functional tests, analyze the ways that specific actions translate to telemetry records, and compare this analysis across different EDR sensors.
Join us and learn:
- The tooling to assist in running these tests and analyzing the resulting telemetry
- How security teams can improve their own functional testing efforts by creating an automated validation workflow
- How this approach has enabled us to more effectively understand and use EDR telemetry, highlighting where this telemetry excels and fails at detecting ATT&CK techniques
Finally, we’ll talk about how you, too, can get started with validating your systems and why ATT&CK is a useful framework in discussing validation.