scope-drift-detection-device

Endpoint process drift is detected by analyzing DeviceProcessEvents against a configurable time window to establish a behavioral baseline and identify new processes, command-line patterns, and account usage deviations.

Behavioral baseline deviation is the quantification of process execution changes over time, scoring volume, processes, accounts, process chains, and signing companies to identify subtle unauthorized activity or misconfigurations.

Fleet-wide analysis is supported with tiered depth for large environments, allowing you to monitor process execution baseline deviations across an entire device fleet or focus on specific endpoints.

Drift detection corroborates findings by integrating with SecurityAlerts and DeviceInfo, providing a comprehensive risk assessment that combines baseline deviations with existing security alert data.

You can investigate unexpected command-line patterns by running single-device analysis on a named endpoint over a specific time window to identify new processes and account usage that signal slow-moving compromise.

Detection relies on DeviceProcessEvents data availability and configurable time windows, meaning short windows may miss slow-moving compromises while large fleets require tiered depth to manage performance.