ConceptsBehavioral Detection

Behavioral Detection

Detecting threats by what an entity does, its behavior and sequences of actions, rather than by matching known-bad signatures. It catches novel and fileless attacks that signature-based detection misses.

Glossary definition

12 direct links1 lesson

Concept Neighborhood

Explore this concept’s connections in the groups below.

PrerequisiteRelated

Start here

Endpoint Telemetry

The foundation Behavioral Detection builds on, worth understanding first.

Open concept →

Prerequisitelearn this first

Endpoint TelemetryStart here

The activity data collected from endpoints, process creation, file and registry changes, network connections, logons, that feeds detection and investigation. It is one of the richest and most important telemetry sources for defenders.

lessons

Relatedsorted by lesson coverage

Indicators of Compromise

lessons

Detection Coverage

lessons

System Calls

lessons

LOLBin Detection

lessons

Pyramid of Pain

lessons

Anomaly Detection

lesson

Show 5 more connections

False Positives

lesson

Indicators of Attack

lesson

Runtime Security

lesson

Sequence Detection

lesson

Signature-Based Detection

lesson

Related Lessons

1 lesson covers this concept

Store, Query, and Govern Telemetry

General Beginner