Product Capability · E-ITDR

Attack investigation
and correlation

A single alert only describes a fragment. An investigation begins from one alert or one asset, organises authentication, process starts and network connections by time and object relationship, and produces a path you can check link by link.

Request a demo Back to overview

Where To Start

An investigation has three ways in

The lead an analyst is handed takes different shapes: an alert, a server someone named, an account that needs checking. All three doors open onto the same correlated view.

From an alert

Start from the rule that matched and the fields that triggered it, then look backwards for where this activity came from and forwards for what it did next. The alert is the entry point, not the conclusion.

The most common path

From an asset

When an external notice, peer intelligence or a shift analyst points at one host, pull its full timeline by stable asset identity — including records from before and after hostname and IP changes.

Depends on stable asset identity

From an account

On offboarding, a permission change or a suspected credential leak, search by account: which hosts it authenticated to, what remote execution it started, which assets it touched.

For after-the-fact checks and routine audit

Correlation

Five dimensions that line scattered events up

Correlation is not sorting events by time. Every relationship has to be able to say what justifies putting these two things side by side.

Dimension	What is correlated	Question it answers
Account	Authentication events, ticket requests, remote execution initiated	Whose identity is moving
Host	Stable asset identity and snapshots of attribute changes	Which machine it happened on
Process	Process creation, parent-child relations, command lines	What it moved with
Connection	Cross-host network connections and interface changes	From where to where
Time	Event times and ordering inside a time window	Whether the sequence holds

The time dimension depends on endpoint clocks. Collection health records clock drift; where drift is large, cross-host ordering needs human confirmation and should not be read as causation on its own.

Reconstruction

From an entry point to a readable path

Every step keeps the raw record it came from. The path is not an automatically generated verdict — it is material you can confirm or overturn one link at a time.

Pick an entry

Expand by relation

Place on a timeline

Check the evidence

Mark the gaps

Every link drills down

Open any segment of the path and land on the raw event fields behind it: which account, which process, which connection, and when.

Renames and new IPs do not break it

Hostname, IP and interface changes are recorded as time-stamped snapshots. A path crossing those changes still points at one asset instead of splitting into two machines.

Gaps stay on the path

Segments where collection did not reach or data is missing are marked separately, so the reader knows that stretch is “not seen”, not “did not happen”.

Path Evidence

What a lateral movement path is made of

A path is worth something because each segment can account for where it came from. These are the elements of a path and the evidence behind each one.

Path element	Content	Evidence source
Source endpoint	The compromised host running an agent, and its stable asset identity	Asset ledger and attribute snapshots
Account and authentication	The account used, the authentication events and when they happened	Logon sessions, PAM / auth, security log
Process and command	Related process creation, parent-child relations, command lines	ETW / proc / eBPF process collection
Cross-host connection	Connections initiated and accepted, interface changes	Network collection and connection snapshots
Assets involved	Hosts and key servers along the path	Events reported by each endpoint
Evidence gaps	Segments where collection did not reach or data is missing	Collection health state

A structural description, not a product screenshot. Paths shown in a demonstration environment come from a product demonstration scenario, not one customer's actual incident record.

Boundaries

Where investigation stops

This capability answers what happened, whose identity was involved and how far it went. The judgement one step beyond that needs other evidence, and these pages do not make it on your behalf.

A link is not causation

A relationship on the path means two events can be matched up in the evidence; it does not confirm that the first caused the second.

An account is not a person

The account used is the subject of the investigation. Confirming who actually operated it takes tickets, access control and HR records, and remains the organisation's judgement.

No actor attribution

Detecting behaviour associated with a class of tooling is not the same as confirming a specific actor or group. Attribution is outside this product's evidence range.

Completeness depends on collection

Hosts without an agent, collectors that were never enabled and audit policies left switched off all leave gaps in the path. Those gaps are marked as they are.

This capability is called Investigation rather than Attribution for exactly that reason: the name should not imply that an attacker has been identified. Investigation findings are for deciding response actions and assessing impact, not for making a public determination.

What Comes Next

Related capabilities

The five capabilities share one body of evidence. Follow the investigation onward, or return to the overview.

File Activity & Exfiltration Investigation

Capability 03

Recorded file activity and network-layer transfer statistics on the same timeline as identity and process evidence.

View capability

Identity Threat & Lateral Movement Detection

Capability 01

Credential access, abnormal authentication, remote execution and host-side signals together judge one suspicious move.

View capability

E-ITDR Product Overview

Product and deployment

Architecture, how the five capabilities divide the work, supported environments and boundaries.

Back to overview

Expert Consultation

Walk one real alert through the whole investigation

Describe a typical alert scenario you deal with, and we will demonstrate every step from entry point to path on the same terms:

Choosing an entry point

Starting from an alert, an asset or an account

Correlation dimensions

What each of the five dimensions matches

How gaps are shown

Marking stretches collection did not reach

Scan with Feishu to consult

Consultation +86 10 8071 6066

Business email services@wuthreat.com