0Pricing
Cyber Security Academy · Lesson

Telemetry and Detection

What EDR collects.

Telemetry and Detection is a free Cyber Security Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

What Is Telemetry

Telemetry is the data an EDR agent collects from an endpoint.

It is the raw record of what is happening on a device, and it is the foundation of every detection.

Process Activity

EDR records every process that starts, including who launched it and what command line was used.

Telemetry sample:
parent: winword.exe
child: powershell.exe
args: -enc ZQBjAGgAbwA...

File and Registry Changes

The agent watches the file system and, on Windows, the registry.

  • New or modified files
  • Files being encrypted rapidly (ransomware sign)
  • Registry keys used for persistence

Network Connections

EDR logs which processes connect where.

A connection to a known malicious server, or an unusual large upload, can reveal data theft or command-and-control traffic.

User and Logon Events

Telemetry includes logons and account use.

  • Logons at odd hours
  • Many failed login attempts
  • A normal user suddenly using admin rights

These hint at compromised accounts.

Signature-Based Detection

One detection method matches activity against known signatures of malware, such as a file hash or a known bad domain.

It is fast and reliable for threats that have already been catalogued.

Behavioral Detection

Behavioral detection looks at patterns of actions instead of fixed signatures.

Example: a Word document launching PowerShell that then downloads a file is suspicious, even if the file is brand new.

Detection Rules

Many EDR platforms use rules to describe suspicious behavior.

A popular open format is Sigma, which lets teams share detection logic in a vendor-neutral way.

title: Office app spawns shell
detection:
  selection:
    ParentImage: winword.exe
    Image: powershell.exe
  condition: selection

Mapping to MITRE ATTACK

The MITRE ATTACK framework catalogs attacker techniques.

EDR alerts often map to ATTACK techniques, helping analysts understand what stage of an attack they are seeing.

Reducing False Positives

Not every alert is real. A false positive is a benign action flagged as a threat.

Teams tune rules and create exceptions so analysts focus on alerts that truly matter.

Threat Hunting

Stored telemetry enables threat hunting: analysts proactively search for hidden attackers.

They query past data for subtle signs that automated alerts may have missed.

Quick Check

Test your knowledge of telemetry and detection.

Recap

EDR collects telemetry such as:

  • Process, file, registry, network, and logon events

It detects threats with signature and behavioral methods, maps them to MITRE ATTACK, and supports proactive threat hunting.

Frequently asked questions

Is the “Telemetry and Detection” lesson free?

Yes — the full text of “Telemetry and Detection” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “Telemetry and Detection”?

What EDR collects. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Telemetry and Detection” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. What Is EDR
  2. Telemetry and Detection
  3. Response Actions
  4. EDR vs Antivirus
← Back to Cyber Security Academy