Endpoint Detection Rule

Endpoint Detection Rule is a security security analytic that matches suspicious behavior or known indicators for user device and server protection. It uses logs, thresholds, signatures, and behavioral context so teams can surface actionable alerts while keeping evidence, reliability, and public-safe operational boundaries clear.

“The security team used Endpoint Detection Rule when a workstation reported suspicious activity, so the team could surface actionable alerts before the risk review began.”