Guided LabSOC Foundations · Entry 22 min
Telemetry: the data a SOC actually sees
You have the map; now learn the terrain. Four telemetry families feed this environment — endpoint, network, identity and cloud — and every investigation moves between them.
Concept
Read this before opening the workspace
Analysts can only see what is collected. Four telemetry families cover almost all SOC work: endpoint (process creation, file and registry activity), network (firewall, proxy, DNS), identity (authentication, privilege change) and cloud (control-plane API activity).
Each family answers a different question. Endpoint tells you what ran. Network tells you where it talked. Identity tells you who did it. Cloud tells you what changed in the platform. Investigations move between families — that movement is called pivoting.
Key terms
- Normalisation
- Mapping vendor-specific fields into one shared schema such as host.name or source.ip.
- Event code
- Vendor identifier for an event type, e.g. Windows 4625 = failed logon.
- Pivot
- Re-querying another source using an entity you already have (host, user, IP, hash).
Learning objectives
- Query each telemetry family
- Explain what question each family answers
- Perform your first pivot between two sources
Prerequisites
- · FD-1 — how security operations work
- · How security operations work (recommended first)