> For the complete documentation index, see [llms.txt](https://docs.sec1.io/user-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sec1.io/user-docs/10-siem-edr-xdr/endpoints-and-telemetry.md).

# Endpoints & Telemetry

Every host running the EDR/XDR agent appears under **XDR → Endpoints**. Selecting a host opens its detail view — a set of tabs, each showing **real data collected from that host**, not samples or estimates.

## Endpoint detail tabs

### Alerts

Detections that fired on this host, with severity, the rule that matched and the time it occurred. This is the host-scoped view of the alerts that feed into incidents.

### Vulnerabilities

Vulnerable software found on the host. Each finding ties an installed package to a known CVE with its severity. See [Vulnerability management](/user-docs/10-siem-edr-xdr/vulnerability-management.md) for the full workflow.

### Applications

The installed software inventory collected from the host — operating-system packages and application dependencies. This inventory is what the vulnerability scan and [application control](/user-docs/10-siem-edr-xdr/application-control.md) rules evaluate against.

### Devices

Connected USB and peripheral devices reported by the host. From here you can approve or block a device — see [Device control](/user-docs/10-siem-edr-xdr/device-control.md).

### File Integrity

File integrity monitoring (FIM) events: creations, modifications and deletions on the paths being watched on the host.

### Activity

Process activity from the host — what ran, when and under which parent process. This feeds the process tree shown in incident investigations.

### Network

Network connections observed on the host, including the owning process for each connection where the agent can resolve it.

### System

Host system facts and metrics — operating system, listening ports, recent logons and resource metrics collected from the host.

## Notes

* Data populates as the agent reports in. A freshly installed host fills its tabs over the first few collection cycles.
* The same telemetry powers detections, vulnerability findings and incident investigations — what you see per host is the same data the platform reasons over.