Host indicators are signs of compromise on an individual endpoint or server. Network indicators tell you that something is talking; host indicators tell you what is running, how it got there and how it survives a reboot. Your main sources are endpoint detection and response (EDR) tools, System Monitor (Sysmon) and operating system logs, plus built-in commands when you are looking at a single machine.
Free account
Keep reading for free
Create a free StudyToCert account to read the rest of this lesson: 7 more sections, 7 key terms, a real-world example, an exam tip and self-check questions. Every lesson, lab and practice test is free with an account.