How EDR Actually Detects an Attack

An attacker does something malicious. Somewhere downstream of that action, a SOC analyst sees an alert. The interesting part isn't that this happens — it's everything that has to occur in between. Thi