Search real-time data of endpoints for investigation and threat hunting

When you are investigating or hunting for a threat, you can search current processes and events happening on the endpoints. This feature helps you to search for endpoint data, specific threat, or alert in real-time.

Note

EDRF for macOS does not support the MD5 and SHA1 hashes.

You can run real-time expressions or queries directly on endpoints remotely to obtain current data. Once the data is displayed, you can also respond to them appropriately.

How to create real-time search queries?

You can create queries using the real-time search syntax that includes projection and filter details.

For details about the real-time search syntax, collectors, and examples, see links added in the below tables.

How to search real-time data?

When the real-time search query is created, you can search real-time data using the Real-time Search dashboard.

For details about searching real-time data and customizing the results displayed, see Search real-time data for investigation and threat hunting.

How to save a real-time search query within EDRF?

When the real-time search query is created, you can save the query within EDRF using Save Searches.

For details about saving the real-time search query, see Save a real-time search query.

For details about running the saved real-time search query, see Run the saved search query.

How to hunt for dormant threats?

When a potential threat is identified and the associated malicious processes are dormant on your endpoints, you can detect them and take appropriate action.

For details about hunting dormant threats, see Hunt for dormant threats using EDRF.

How to respond to threats?

For details about responding to threats remotely on multiple endpoints, see Respond to threats.