Endpoint Telemetry Guide: What to Collect and How to Use It

Most intrusions are visible on an endpoint before they become a breach, but only if the right events were collected, kept and joined together. Endpoint telemetry is the stream of process, file, registry, network, authentication and script events that EDR agents and native operating system logs produce. Teams often either collect too little (default Windows auditing, no command lines) or too much (every image load from every server) and then cannot afford to keep it. This guide sets out what to collect on Windows and Linux, how native sources such as Sysmon, ETW and auditd compare with EDR telemetry, how to map collection to MITRE ATT&CK data components, and how to measure telemetry gaps. It is for detection engineers, SOC leads and endpoint administrators.

Key takeaways

• Process creation with full command line is the minimum. Without parent process, command line and user, most living-off-the-land and script-based activity is invisible.
• Collect by data component, not by product. MITRE ATT&CK v20 has deprecated its old data sources in favour of data components such as DC0032 Process Creation; map each one to a concrete log source and check coverage.
• EDR telemetry and native logs are complementary. EDR gives rich, correlated events but on the vendor's terms and retention; Sysmon, Windows Security auditing and auditd give data you control and can keep longer.
• Telemetry can be switched off. Attackers target agents and logs (ATT&CK T1685 Disable or Modify Tools), so the absence of telemetry must itself raise an alert.
• Telemetry contains secrets. Command lines and PowerShell script blocks capture passwords and tokens; protect the pipeline and the SIEM like a credential store.

What endpoint telemetry is and where it comes from

Telemetry differs from alerts: it is the raw, mostly benign record of what happened, which detections, hunts and investigations query later. Four layers produce it.

For product selection, see the EDR and XDR Buyer's Guide. For platform-specific depth, see the Linux Detection and Response Guide and the macOS Detection and Response Guide.

What to collect: the core event set

Start from the behaviours you need to see, then pick the cheapest reliable source for each. The table maps ATT&CK v20 data components to Windows and Linux sources. Data component IDs come from the ATT&CK v20 dataset; the ATT&CK log source names (for example WinEventLog:Sysmon, auditd:EXECVE, ebpf:syscalls) are listed against each component.

ATT&CK v20 also links data components to detection strategies, for example DET0455 Abuse of PowerShell for Arbitrary Execution and DET0363 Detection of Credential Dumping from LSASS Memory via Access and Dump Sequence. Use these as a check that you collect what each strategy needs. See the Detection Engineering Guide.

Windows: native configuration that matters

• Advanced audit policy: configure under Security Settings\Advanced Audit Policy Configuration. At minimum enable Detailed Tracking: Audit Process Creation; Logon/Logoff: Audit Logon and Audit Special Logon; Account Logon: Audit Kerberos Authentication Service and Audit Credential Validation; Account Management: Audit Security Group Management and Audit User Account Management; Policy Change: Audit Audit Policy Change. Enable Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings, otherwise legacy category settings can overwrite them (event 4719 records such changes).
• Command lines in 4688: enable Administrative Templates\System\Audit Process Creation\Include command line in process creation events. Microsoft warns that command lines are then written in plain text to the Security log and can include passwords, and anyone who can read Security events can read them.
• PowerShell: enable Turn on PowerShell Script Block Logging (event 4104). Windows PowerShell writes to Microsoft-Windows-PowerShell/Operational; PowerShell 7 uses its own PowerShellCore channels. Microsoft recommends Protected Event Logging, which encrypts logged content with a public-key certificate (Document Encryption EKU) so only the holder of the private key can read it.
• Sysmon: install with an XML configuration (-i, updated with -c). Set HashAlgorithms (MD5, SHA1, SHA256, IMPHASH), enable event 3 for network connections and event 22 for DNS queries, and be selective with event 7 image loads. In filtering, exclude rules take precedence over include rules, so a broad exclude can silently remove what you meant to keep. See the Sysmon Guide.
• Log sizes and forwarding: default channel sizes roll over within hours on busy hosts. Windows Event Forwarding (WEF) sends selected events to a Windows Event Collector; Microsoft suggests planning about 3,000 events per second per collector and using a baseline subscription for all devices plus a targeted "suspect" subscription for devices under investigation. See the Windows Event Log Guide.

ETW in one paragraph

Event Tracing for Windows has controllers that start sessions and enable providers, providers that emit events (manifest-based, TraceLogging, MOF and WPP types), and consumers that read sessions in real time or from log files. Microsoft documents that events are lost when a real-time consumer cannot keep up or a log disk is too slow, which is why EDR health metrics should include dropped-event counts, not just agent heartbeat.

Linux: auditd and eBPF

• Rules as files: put persistent rules in /etc/audit/rules.d/ and load with augenrules --load. Red Hat ships sample sets (30-stig.rules, 30-pci-dss-v31.rules, 30-ospp-v42*.rules) but warns they are neither exhaustive nor current.
• Prefer syscall rules: -a always,exit -F arch=b64 -S execve -k exec (and a matching arch=b32 rule on 64-bit systems) records process execution. The auditctl manual describes the -w watch form as deprecated for performance reasons.
• Lock the configuration: end rules with -e 2 so changes need a reboot, and decide the failure mode (-f 1 logs a kernel message, -f 2 panics, for high-security systems). Raise the backlog (-b, kernel default 64) on busy hosts.
• Check for silent exclusions: many distributions install an -a never,task rule that skips audit processing for new processes; run auditctl -l to confirm your rules apply.
• Protect the local log: in auditd.conf set max_log_file_action = keep_logs and define space_left_action and disk_full_action; forward events off the host promptly.
• eBPF sensors: eBPF programs attach to syscalls, tracepoints, kprobes and uprobes, pass a verifier before loading, and share data through maps such as ring buffers. Many modern Linux EDR and open-source runtime security tools use it because it gives process and container context at low overhead.

Containers need the same events tagged with container and pod identity; without that, a process tree from a Kubernetes node cannot be tied to a workload.

Normalising and joining telemetry

Raw events from Sysmon, 4688, auditd and an EDR all describe process creation differently. Normalisation is what lets one detection run across them.

• Use a common data model: the Open Source Security Events Metadata project (OSSEM, from OTRF) provides OSSEM-DD data dictionaries per provider, OSSEM-CDM a common data model, and OSSEM-DM a detection model relating events to adversary techniques. Vendor schemas such as the Microsoft Defender advanced hunting tables (DeviceProcessEvents, DeviceNetworkEvents, DeviceFileEvents, DeviceRegistryEvents, DeviceLogonEvents, DeviceImageLoadEvents) follow the same idea.
• Join keys: host identifier, process GUID or process ID plus start time, parent process, logon ID, user and session. Sysmon's ProcessGuid and Windows LogonId let you join a process to the logon that created it.
• Time: keep all endpoints on one time source and store UTC; an hour of skew breaks sequence detections.
• Enrich at ingest: asset owner, criticality, device role and whether an account is human or a service account. See the SIEM Guide and the Security Data Lake Guide.

Choosing where telemetry lives

Small organisations should usually rely on EDR telemetry plus Windows Security and PowerShell logs forwarded to one place. Large organisations should own a raw copy of the core event set for at least the period needed for incident investigation, because dwell times and regulatory deadlines often outlast default EDR retention.

Where identity fits

Endpoint telemetry is where credential theft becomes visible: LSASS access (T1003.001), browser cookie theft, keyloggers and token use from unusual processes. Two incidents show the gap. In the CircleCI breach, malware on an engineer's laptop stole a 2FA-backed SSO session and CircleCI stated it was not detected by its antivirus software; behavioural telemetry on browser credential stores and unusual child processes is what catches this class of attack. In the LastPass breach, a keylogger on an engineer's home computer captured a master password, a reminder that devices outside the telemetry estate should not hold privileged access. Tag service accounts in telemetry so that interactive logons (4624 logon type 2 or 10) by a service account stand out. See the Service Account Security Guide.

Implementation roadmap

1. Inventory coverage: list every endpoint class (workstations, servers, VDI, Linux, macOS, containers) and which sensors and logs each runs today. Compare against the asset inventory; the difference is your first telemetry gap.
2. Set the baseline event set: apply the core table above through Group Policy or Intune for Windows and configuration management for Linux, starting with a pilot ring of 50 to 100 representative hosts.
3. Measure volume in the pilot: record events per host per day by event type for two weeks; tune Sysmon and auditd exclusions for known noisy, benign processes, and document each exclusion with an owner.
4. Validate with tests: run controlled ATT&CK technique tests (for example a benign encoded PowerShell command or a service creation) and confirm each produces the expected event in the SIEM within your latency target.
5. Roll out in rings: extend to 10%, then 50%, then all hosts, checking agent CPU, dropped events and ingest cost at each stage.
6. Roll back safely: keep the previous Sysmon configuration and audit GPO versioned; reverting is a configuration push (sysmon -c with the old file, or relinking the previous GPO), not an uninstall.
7. Operate: review coverage monthly, and re-test after every EDR, OS or configuration change.

Detection and measurement

Telemetry about telemetry is the first detection to build. Alert on stopped Sysmon or EDR services (Sysmon event 4 records service state changes), audit policy changes (4719), Security log cleared (1102), System log cleared (104), and hosts that go silent while still seen on the network. These map to ATT&CK T1685 Disable or Modify Tools, T1685.001 Disable or Modify Windows Event Log and T1685.005 Clear Windows Event Logs under the Defense Impairment tactic (TA0112). See the EDR Evasion and Defence Guide.

Common failure patterns

• Process events without command lines: 4688 enabled but the command line policy left at its default, so the event says powershell.exe started and nothing more.
• Exclusions that blind: broad Sysmon or EDR exclusions for "trusted" paths or tools that attackers then use. See the EDR Tuning and Exclusions Management Guide and the Living off the Land Guide.
• Linux servers left out: Windows has an agent everywhere, while Linux and container hosts run with default audit rules or none.
• Secrets in the SIEM: command lines and script blocks with passwords sit readable by every analyst and every integration account.
• No alert on silence: an agent stopped or a log cleared produces no alert because detections only look for bad events, not missing ones.
• Retention shorter than investigations: raw telemetry kept for days while incidents are discovered weeks later.

Framework mapping

In CIS Controls v8.1 this sits in Control 8 (Audit Log Management), including collecting detailed audit logs and command-line audit logs, and Control 13 (Network Monitoring and Defense) for host-based intrusion detection.

Practitioner checklist

• Compare sensor coverage against the asset inventory weekly and ticket every gap.
• Enable Audit Process Creation with command lines, and force subcategory audit settings.
• Turn on PowerShell script block logging and evaluate Protected Event Logging.
• Deploy Sysmon or equivalent EDR events for process access, network, DNS, driver and registry activity.
• Apply auditd execve, connect, ptrace and module load rules on Linux, locked with -e 2.
• Map collection to ATT&CK v20 data components and record gaps per platform.
• Normalise to one schema with consistent join keys and UTC timestamps.
• Alert on stopped agents, cleared logs, audit policy changes and silent hosts.
• Restrict who can read raw command-line and script telemetry.
• Re-run technique tests after every agent, OS or configuration change.

Standards and references

• MITRE ATT&CK: Process Creation data component
• Microsoft: Sysmon
• Microsoft: About Event Tracing
• Microsoft: Command line process auditing
• Microsoft: about_Logging_Windows
• Linux man-pages: auditctl(8)
• eBPF.io: What is eBPF?
• OTRF: Open Source Security Events Metadata (OSSEM)

Related NHI Mgmt Group resources: SIEM Guide · EDR and XDR Buyer's Guide · EDR Evasion and Defence Guide · Endpoint Security Guide · Threat Hunting Guide