Security Telemetry Stops at the Endpoint

Detection capability relies almost entirely on endpoint and server telemetry. Identity, DNS, VPN, firewall, SaaS, email, hypervisor, RMM, application, and cloud infrastructure events are missing, incomplete, or unusable.

The endpoint is treated as if it were the entire network. Yet a growing share of an attack can unfold without executing any visible code on a workstation: session theft, mailbox rule manipulation, legitimate remote access, cloud changes, API abuse, or an attack against a management platform.

An EDR can answer the question “what happened on this machine?” admirably while being unable to say who authenticated, where the connection came from, which services were accessed, or whether the same account is active elsewhere.

The team sees an isolated episode where a campaign actually exists. It may clean a workstation without revoking a session, close off malware without closing off the initial access, or overlook a compromise that never touches a managed endpoint.

The lack of correlation across layers lengthens analysis time and increases the risk of false containment.

• Enumerate the sources needed to reconstruct an authentication event, a DNS resolution, a remote connection, an administrative change, and a network flow.
• Check which of these are centralized, correctly timestamped, retained long enough, and actually queried during an investigation.
• Take a malware-free abuse scenario and ask what alert it would generate.
• Look for blind spots on the systems that control everything else: identity, network, hypervisors, backups, RMM, and SaaS.
• Examine whether analysts can correlate a user, an address, a device, and a session across multiple platforms.

• Define priority threat scenarios, then determine the sources needed to detect and investigate them.
• Centralize identity, remote access, network, infrastructure, and critical service logs, with retention aligned to plausible dwell time.
• Normalize timestamps and identifiers to enable correlation.
• Monitor for the arrival of the logs themselves; a silent source should trigger an alert.
• Regularly test scenarios that do not rely on malware execution on an endpoint.

• Quickly map available sources, their retention, and their blind spots.
• Immediately preserve short-lived logs from the relevant platforms.
• Extend the investigation to identities, sessions, network flows, remote access, applications, and administrative consoles.
• Use vendor or cloud-provided sources even if they weren’t centralized, documenting their limitations.
• Do not conclude that no activity occurred simply because the EDR detected nothing.