Endpoints & Telemetry

Every host running the EDR/XDR agent appears under XDR → Endpoints. Selecting a host opens its detail view — a set of tabs, each showing real data collected from that host, not samples or estimates.

Endpoint detail tabs

Alerts

Detections that fired on this host, with severity, the rule that matched and the time it occurred. This is the host-scoped view of the alerts that feed into incidents.

Vulnerabilities

Vulnerable software found on the host. Each finding ties an installed package to a known CVE with its severity. See Vulnerability management for the full workflow.

Applications

The installed software inventory collected from the host — operating-system packages and application dependencies. This inventory is what the vulnerability scan and application control rules evaluate against.

Devices

Connected USB and peripheral devices reported by the host. From here you can approve or block a device — see Device control.

File Integrity

File integrity monitoring (FIM) events: creations, modifications and deletions on the paths being watched on the host.

Activity

Process activity from the host — what ran, when and under which parent process. This feeds the process tree shown in incident investigations.

Network

Network connections observed on the host, including the owning process for each connection where the agent can resolve it.

System

Host system facts and metrics — operating system, listening ports, recent logons and resource metrics collected from the host.

Notes

• Data populates as the agent reports in. A freshly installed host fills its tabs over the first few collection cycles.

• The same telemetry powers detections, vulnerability findings and incident investigations — what you see per host is the same data the platform reasons over.