55. Endpoint telemetry in the console: hunt, process trees, attack stories and profiles

Agents on Windows and Linux report what runs on the host: processes started and ended with their command lines, network connections, DNS lookups and writes to sensitive files. The server keeps this telemetry in the log store, runs the detection rules on it, and the console shows it on four screens under Investigation > Telemetry, plus a health panel on each agent. Telemetry follows the demo rule like every other screen: demo hosts show demo telemetry, only with the demo licence, and Clear demo data removes it.

Permissions: reading follows the log store; the hunt also needs the forensics module in the licence. Changing a profile or the retention needs Manage telemetry (manage_telemetry); uploading and activating Sysmon needs Publish agent releases. Telemetry > Overview lists every host with its collector, profile, cost, lost events and state.

55.1 Hunt: search every host#

Telemetry > Hunt builds a search over the telemetry of all hosts, for example who ran certutil in the last 7 days.

1. Pick a field (host, process image, command line, parent image, user, SHA-256, destination IP, file path, DNS name, event kind, collector, OS), an operator (is, is not, contains, starts with, ends with) and a value. * is a wildcard. Choose Add condition for more; every condition must match.
2. Choose the Time range (1 hour to 31 days).
3. To count instead of list, tick one or more Count by boxes (host, image, command line, user, destination IP, parent image, event kind).
4. Choose Run hunt. The Query box shows exactly what is sent; you may edit it by hand (the label then says so). It is the log query language, never SQL; a bad field gets an error naming it. The query uses full field names such as fields.process.executable, so it also runs unchanged in Logs.
5. Event rows show time, host, kind, image, command line, user, parent, destination and path; the + at the start of a row opens the full event (every field and the raw event). Counts show one column per group.
6. In the results, Host adds a "host is ..." condition so you can narrow to that machine, and Tree opens the process tree of that process.

Save hunt keeps the query and its time range under a name; saved hunts appear as buttons, one click runs one, and the bin icon deletes it. Saved hunts are stored with the console's saved searches (a hunt: prefix in the name), private to you. A saved hunt keeps at most 30 days even if the hunt itself ran over 31; the console says so when it cuts the range.

55.2 Process tree#

Telemetry > Process tree shows one process on one host with its ancestors and descendants. Pick a host; the console lists its recent process starts to choose from, or you arrive from a hunt result, an attack story or a link with the host and process already set.

Each row shows the program, process id, user, start time, command line, and small counters for connections and file writes. The row of the process you came for is highlighted. Click a row to open its details: image path, integrity level, SHA-256, start and end, exit code, every network connection (direction, addresses, ports), every file write and the DNS names it looked up. The chevron collapses or expands the branch. The search box filters by image, command line, user, hash, process id, address, file or DNS name and keeps the path from the top to every hit, so a match is always shown in context.

A note says when the tree was cut at the server's size cap, and rows marked "seen as parent only" are processes known only because a child named them.

55.3 Attack story#

Telemetry > Attack story, or Attack story in an alert's drawer in Logs > Alerts, expands one alert into its chain: the process that started it, its children, their connections and the files they wrote, in time order, with the ATT&CK techniques of the alert at the top and of each step that carries one. The process tree sits underneath with the alert's process highlighted and open. An alert with no telemetry says so instead of showing an empty chain. You can also type an alert number.

55.4 Profiles and retention#

Telemetry > Profiles sets how much each group of hosts reports.

1. Find the host group (or Default, for hosts in no configured group).
2. Choose the profile, or untick Collect telemetry to turn it off for the group.
3. Optionally open Filters (one entry per line): images to leave out, the only paths whose writes are reported, and destination networks (CIDR) to leave out. Globs only, no regular expressions.
4. Save group. Agents pick the change up on their next heartbeat. Collecting less than now (a lower profile, switching off, more exclusions) needs a second administrator where approvals are required; the page then says it was sent as a request.

A group with no setting of its own is marked inherits the default; Give this group its own setting creates one and Revert to default removes it again (four-eyes when it collects less). Notes at the top say when the licence does not include telemetry or the server has it switched off.

Retention (14 days by default, 1 to 365) applies to all telemetry. On a standalone (SQLite) install the page says telemetry is limited to the light profile and 3 days, and the other profiles and the retention field are locked.

55.5 Agent telemetry health#

Open an agent in Agents and read Endpoint telemetry: the collector in use (Sysmon, ETW without Sysmon, eBPF, or the proc-connector fallback on older Linux kernels, or "none running"), the profile, the agent's own CPU and memory against its profile's budget, dropped events (events filtered by your policy are not counted as loss) and the last batch time. If the agent was over budget for 10 minutes and stepped down a profile, a warning says from which to which.

A warning from the server, and any lost events (batches the store refused, kept on the host) are shown with Acknowledge to clear the note (Manage telemetry). A stepped-down host has Reset to <profile> to put it back on its group's profile. macOS hosts show that telemetry covers Windows and Linux only.

On Windows hosts the panel also shows the Sysmon state of the host (for example lawliet config, builtin feature, absent), the policy, and the binary on offer. Lawliet never ships Sysmon: until it is present the agent collects with ETW. With Publish agent releases the panel also lists the uploaded binaries:

1. Upload Sysmon64.exe (the file from Microsoft). The server keeps it only when it is signed by Microsoft Corporation and the signature covers that exact file; otherwise it says why. An identical file is refused as a duplicate.
2. Activate offers it to every Windows agent. This is the four-eyes step: a second administrator approves it, and the panel shows the request number. Agents install it on their next heartbeat after approval.
3. Withdraw stops offering it (hosts that already installed Sysmon keep it). Delete removes an inactive binary. Both ask you to confirm.

The panel shows the Sysmon policy (management automatic or off, and whether Lawliet's configuration replaces the site's). Changing it, the domain-controller list and the configuration download are in 52.4 and 52.5.

The Lost events figure is the server's count of events lost on the host; events refused by the store are shown separately as quarantined, and events filtered by your policy are not loss.