Telemetry and Detection
What EDR collects.
Telemetry and Detection is a free Cyber Security Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What Is Telemetry
Telemetry is the data an EDR agent collects from an endpoint.
It is the raw record of what is happening on a device, and it is the foundation of every detection.
Process Activity
EDR records every process that starts, including who launched it and what command line was used.
Telemetry sample:
parent: winword.exe
child: powershell.exe
args: -enc ZQBjAGgAbwA...File and Registry Changes
The agent watches the file system and, on Windows, the registry.
- New or modified files
- Files being encrypted rapidly (ransomware sign)
- Registry keys used for persistence
Network Connections
EDR logs which processes connect where.
A connection to a known malicious server, or an unusual large upload, can reveal data theft or command-and-control traffic.
User and Logon Events
Telemetry includes logons and account use.
- Logons at odd hours
- Many failed login attempts
- A normal user suddenly using admin rights
These hint at compromised accounts.
Signature-Based Detection
One detection method matches activity against known signatures of malware, such as a file hash or a known bad domain.
It is fast and reliable for threats that have already been catalogued.
Behavioral Detection
Behavioral detection looks at patterns of actions instead of fixed signatures.
Example: a Word document launching PowerShell that then downloads a file is suspicious, even if the file is brand new.
Detection Rules
Many EDR platforms use rules to describe suspicious behavior.
A popular open format is Sigma, which lets teams share detection logic in a vendor-neutral way.
title: Office app spawns shell
detection:
selection:
ParentImage: winword.exe
Image: powershell.exe
condition: selectionMapping to MITRE ATTACK
The MITRE ATTACK framework catalogs attacker techniques.
EDR alerts often map to ATTACK techniques, helping analysts understand what stage of an attack they are seeing.
Reducing False Positives
Not every alert is real. A false positive is a benign action flagged as a threat.
Teams tune rules and create exceptions so analysts focus on alerts that truly matter.
Threat Hunting
Stored telemetry enables threat hunting: analysts proactively search for hidden attackers.
They query past data for subtle signs that automated alerts may have missed.
Quick Check
Test your knowledge of telemetry and detection.
Recap
EDR collects telemetry such as:
- Process, file, registry, network, and logon events
It detects threats with signature and behavioral methods, maps them to MITRE ATTACK, and supports proactive threat hunting.
Frequently asked questions
Is the “Telemetry and Detection” lesson free?
Yes — the full text of “Telemetry and Detection” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “Telemetry and Detection”?
What EDR collects. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Telemetry and Detection” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- What Is EDR
- Telemetry and Detection
- Response Actions
- EDR vs Antivirus