A user opens a phishing attachment. winword.exe runs a malicious macro that spawns powershell.exe with a base64-encoded command — a classic suspicious pattern: an Office application spawning a scripting engine it would never legitimately need.
The EDR sensor — running at the kernel level, always-on — hooks process creation, parent/child relationships, command-line arguments, file writes, and network connection attempts in real time. This happens regardless of internet connectivity; events are queued locally if the endpoint is temporarily offline.
SensorThe sensor streams this event data up to the vendor's cloud over an encrypted channel in near-real-time. The heavy detection logic mostly lives in the cloud rather than on the endpoint — which is exactly why the local sensor's resource footprint stays small.
TelemetryThe cloud engine evaluates the event stream against behavioral Indicators of Attack (IOAs) — patterns like "Office app spawns PowerShell with an encoded command" — rather than relying solely on static file-hash Indicators of Compromise (IOCs). This is what catches a payload that has never been seen before anywhere: the behavior is suspicious even if the file itself isn't on any blocklist.
IOAThe cloud maintains a live process ancestry graph for the host: winword.exe → powershell.exe → (outbound connection attempt). This lineage is what lets an analyst see the full story — where the activity originated and what it tried to do next — instead of just a single flagged file in isolation.
The behavior pattern crosses a severity threshold. A Detection is generated — assigned a severity (e.g. "High"), often mapped to a MITRE ATT&CK technique (e.g. T1059.001, PowerShell) — and appears in the SOC console within seconds of the original event, frequently before any real damage (like a successful C2 callback) has completed.
CheckpointDepending on policy, this simultaneously (a) triggers an automated prevention action — killing the process, quarantining the file — and/or (b) routes the detection to the SOC's queue or SIEM for human triage. Prevention of a single malicious action and full host containment are not the same thing — one can happen without the other.
AlertA SOC analyst reviews the process tree, command line, file hash reputation, and any network connections attempted, deciding whether this is a true positive requiring escalation or a false positive (e.g. a legitimate but unusually-written admin script).
TriageThe analyst — or a pre-approved automated response policy for sufficiently high-confidence detections — decides to isolate the host. This is a judgment call balancing "stop any further spread immediately" against "don't disrupt a legitimate business process without solid evidence."
DecisionThe analyst clicks "Network Contain" in the console (or an automated policy fires it). A command travels down through the same cloud management channel to the sensor already running on the endpoint — no ticket to the network team, no switchport or firewall change required.
ContainThe kernel-level sensor immediately restricts the host's own network stack to communicate only with the vendor's cloud for continued management and telemetry. Every other network path — including any attempted C2 callback — is blocked at the endpoint itself. This is the key mechanism: isolation happens at the host, not by reconfiguring any network device.
IsolationBecause the management channel stays open, the analyst retains full visibility and can still run remote response actions — process listing, file retrieval, memory dump — through the same console, continuing the investigation on a host that is otherwise cut off from the rest of the network.
ForensicsThe analyst kills any remaining malicious process, removes persistence mechanisms, confirms the host is clean, then manually lifts containment. The host returns to normal network access — isolation is deliberately not self-expiring, so a host can't accidentally rejoin the network before it's actually been cleared.
Release| Term | Meaning |
|---|---|
| EDR | Endpoint Detection and Response — continuous behavioral monitoring, detection, and response tooling for endpoints |
| IOA | Indicator of Attack — a behavioral pattern suggesting malicious activity, independent of any known file signature |
| IOC | Indicator of Compromise — a static artifact (hash, IP, domain) tied to already-known malicious activity |
| MITRE ATT&CK | A standardized framework mapping observed techniques (e.g. T1059.001) to known adversary tactics |
| Process Tree / Lineage | The parent-child ancestry of processes on a host, used to trace an attack back to its origin |
| Network Containment | Host-level network isolation enforced by the sensor, leaving only the management channel open |
| Tamper Protection | Kernel-level defenses preventing the sensor itself from being disabled or uninstalled by malware or a user |
| C2 | Command and Control — the channel malware uses to communicate with an attacker-controlled server |
| SIEM | Security Information and Event Management — aggregates and correlates alerts from EDR and other sources |
| Dwell Time | The elapsed time between initial compromise and detection/containment — a key SOC performance metric |