Coverage is a measurement, not a deployment status
Deployment dashboards report installed sensors. What matters is sensors that are running, current, reporting within the expected interval, and matched against an authoritative asset inventory that includes assets nobody deployed to.
The reconciliation between the endpoint inventory and the corporate asset inventory is where real gaps appear: contractor devices, lab machines, servers built from an old image, and workloads created outside the standard pipeline.
- Reconcile sensor inventory against directory, cloud and network discovery weekly
- Alert on silent sensors before they are one interval late, not one day late
- Treat unmanaged assets as an exposure with an escalation clock
Telemetry selection: value per gigabyte
Process creation, command line, module load, script block, network connection and authentication events carry most detection value. Full file-system and registry telemetry inflate volume enormously for marginal detection gain outside targeted investigations.
The right posture is a tiered profile: broad low-volume telemetry everywhere, deep telemetry on tiered assets and on any host under investigation, enabled automatically when a case opens.
Behavioural detection requires tuning discipline
Behavioural rules degrade as environments change. Without an owner, a review interval and a measured false-positive rate, they become a permanent noise source that trains analysts to close alerts without reading them.
Suppression must be scoped and time-boxed: per host group, per binary hash, with an expiry date and a review. Global suppression by rule name is how detections silently disappear.
- Every rule has an owner and a review interval
- Suppressions scoped and expiring, never global and permanent
- Analyst feedback recorded on the alert, feeding the tuning backlog
Containment guarantees and forensics
Isolation must preserve investigative access, capture volatile evidence before the network is cut, and be reversible by the analyst who applied it. Rollback for remediation actions — quarantine, kill, registry change — must be documented per action type.
- Volatile capture before isolation: process list, network state, memory when warranted
- Isolation reversible within a stated time by the case owner
- Chain of custody recorded for every artifact collected