QuestionQ64

VerifiedEvent Search

You are investigating a suspicious file execution on a host and need to determine how the process interacted with the system.

Which combination of key data event types should be used in this scenario to understand the process execution and its network activity?

Explanation

ProcessRollup2 provides the execution context for a process, while NetworkConnectIP4 records the IPv4 connections made by that process. Correlating their process identifiers associates an executed process with its remote network activity.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!