An endpoint shows an unusual file modification and an unexpected user-account action. Explain how an analyst could use EDR information to assess the situation.

### The concept EDR records file modifications, user-account actions, and other endpoint activity. An analyst can examine this telemetry, compare the observed behavior with an established baseline, and consider whether it aligns with known indicators of attack. If a correlation platform contains other security logs, those may provide additional context. An unusual action is a reason to investigate, not proof by itself that an attack occurred. ### What a good answer covers - Identify the relevant EDR records and endpoint activity. - Compare the activity with the established baseline. - Consider known indicators of attack and related evidence. - Make a response decision only after contextual assessment. ### Terms - **Known indicator of attack**: A recognized sign associated with a possible attack. ### Remember Use endpoint evidence and context together before labeling unusual activity an incident.