win:edr
EDR / XDR telemetry (Defender for Endpoint, CrowdStrike, SentinelOne, Elastic Defend, Endgame)
Product telemetry; event keys are the vendor's table or event names
- Host type
- Windows (workstation, member server, domain controller)
- Cost class
- Free tool
- Techniques
- 13
- Rules listed
- 0
- Events
- 0
Licensing
- License or service
- Elastic Basic (free) ; Platinum/Enterprise for advanced protections
- What is free
- Telemetry/event collection and malware prevention on Basic (Elastic staff)
- What costs
- Ransomware/memory/behavior protection need Platinum+
- Notes
- Subscriptions page tier marks not parseable
- As read on
- 2026-11-01
A vendor statement as read on the date shown; the cost class is the durable part.
Standards and guidance naming this source
| Requirement | Relation | Basis |
|---|---|---|
| OMB M-26-14: Security tooling alerts | Supports an activity | our analysis: EDR alerts |
| ASD ACSC / CISA et al.: Priority enterprise log sources | priority_source | quoted: security-related and critical software |
Techniques
- T1027.005 Indicator Removal from Tools
- T1027.006 HTML Smuggling
- T1027.008 Stripped Payloads
- T1027.009 Embedded Payloads
- T1036.003 Rename Legitimate Utilities
- T1055.005 Thread Local Storage
- T1059.003 Windows Command Shell
- T1059.006 Python
- T1070.006 Timestomp
- T1070.007 Clear Network Connection History and Configurations
- T1124 System Time Discovery
- T1127.001 MSBuild
- T1552.002 Credentials in Registry
Rules
No vendor rule names this event or source directly.
Events
No event-level rows: this source is tiered as a whole.