Product Capability · E-ITDR

File activity and
exfiltration investigation

After the path comes the question of impact. E-ITDR puts the file activity and network transfer it has already collected on the same timeline as the identity and process evidence before it, so the possible blast radius can be judged from records rather than assumption.

Request a demo Back to overview

What Is Recorded

Impact should be stated from recorded fact

Path investigation answers where the attacker went. The next question is what they did once there. The material for that is file activity and network transfer — both drawn from records already collected at the endpoint.

File activity records

Directories and files a suspicious process reached, and the creation, modification and deletion actions on them.

Granularity follows the collection level

Transfer statistics

Destination addresses, protocol channels and data volume of outbound connections — an observation made at the network layer.

Network-layer statistics

Joined to the attack chain

Abnormal authentication, file access and outbound activity sit on one timeline instead of in three separate records.

Shares the investigation timeline

Evidence retention

The raw records behind an investigation's conclusions can be exported for incident reporting and later verification.

For internal reporting

Scope

What this capability answers, and what it does not

Stating the boundary up front costs less than explaining it afterwards. This table is for aligning expectations, particularly under regulatory enquiry or when reporting upwards.

Question	Answerable	Basis
Which processes reached which directories and files	Yes	Endpoint file activity records
How much data went to which addresses	Yes	Network-layer transfer statistics
Whether these actions belong to the same activity	Yes	Same timeline as identity and process evidence
What the file contents are	No	Content is never read or classified
Whether it falls under a sensitivity class	No	No content classification; needs your own data grading
How many people or records are affected	No	Needs business mapping; cannot be inferred from a file count

Exfiltration figures are network-layer statistics; sensitivity is not identified from file content. One outbound connection is not a confirmed data breach, and without content classification and business mapping you cannot derive from it how many people or records were affected.

One Timeline

Continues the investigation instead of starting a second record

File and transfer evidence hangs off the same attack chain. So when someone asks which data was touched after that movement, the answer does not have to be stitched together across systems.

Abnormal authentication

Cross-host movement

File access

Outbound connection

Evidence export

Times must line up to count as one activity

File access has to fall inside that identity's activity window before it joins the movement that came before it. Records that do not line up are listed separately rather than forced into the chain.

The process anchors both ends

When one process both produced the file access and opened the outbound connection, the two kinds of evidence have a clear owner instead of being inferred from proximity in time.

Missing links are still marked

Where file collection was disabled or permissions were insufficient, that stretch is blank rather than “did not happen”, and the report should keep that uncertainty.

Prerequisites

Collection settings decide how much detail you get

This capability is more sensitive to collection configuration than the others. Walking through this table before a pilot avoids finding out afterwards that a key link was never switched on.

Prerequisite	If it is not met	How to check
File collection enabled	Only process and connection evidence remains; the file side is blank	Collector state in collection health
Sufficient runtime permissions	Some directories are invisible and records are incomplete	The agent's run-as account and directory permissions
Matching collection level	Granularity is too coarse — directory level only, not file level	The on-demand collection level configuration
Network-side observability	No volume or destination for outbound connections	Network collection and protocol identification settings
Storage and retention	Records have expired by the time you look back	Retention policy on the platform side

Windows currently covers the agent's own integrity, excluding general file-change monitoring; Linux provides file tracking and file integrity. The two are not promised at the same coverage.

Not A DLP

The line between this and content-level data loss prevention

What this capability provides is investigative evidence, not content control. The two solve different problems and are complete only when used together.

A different vantage point

It starts from one confirmed suspicious activity and asks what it touched — not a standing content inspection of all data flows.

Content is never read

What is recorded is the access and the transfer as actions. File contents are not parsed and no sensitivity verdict is made.

No real-time blocking

Blocking outbound activity belongs to the network side or a DLP product. What this product supplies is the evidence and the basis for a response decision.

How it relates to compliance work

The output is a verifiable activity record, for your organisation to assess and report against its own data grading and the applicable legal standard.

How and when an incident is reported externally is determined by your organisation under the applicable regulations and the requirements of the competent authority. This product supplies records and evidence; it does not replace legal or compliance judgement.

What Comes Next

Related capabilities

The five capabilities share one body of evidence. Follow the investigation onward, or return to the overview.

Response & Audit

Capability 04

Issue, receive, execute and review each carry a visible state; high-risk actions are governed by approval and review.

View capability

Attack Investigation & Correlation

Capability 02

Authentication, processes and connections organised by time and object, reconstructing the path with gaps marked.

View capability

E-ITDR Product Overview

Product and deployment

Architecture, how the five capabilities divide the work, supported environments and boundaries.

Back to overview

Expert Consultation

Check what an impact assessment can actually answer

Tell us the impact questions you need to answer, and we will say which the records can support and which need your own data grading:

Prerequisite check

File collection, permissions and retention

Blast radius walkthrough

What one activity actually touched

Boundary with DLP

How this divides from content-level control

Scan with Feishu to consult

Consultation +86 10 8071 6066

Business email services@wuthreat.com