scope-drift-detection-device

What problem does it solve?

This Skill detects subtle, gradual changes in device process execution behavior that may indicate unauthorized activity or misconfigurations, which traditional alerts often miss.

Core Features & Use Cases

• Behavioral Baseline: Establishes a normal process execution baseline for devices.
• Drift Scoring: Computes a weighted score across Volume, Processes, Accounts, Process Chains, and Signing Companies to quantify deviation.
• Fleet-wide & Single-Device Modes: Analyzes entire device fleets or focuses on specific endpoints.
• Corroboration: Integrates with SecurityAlerts and DeviceInfo for comprehensive analysis.
• Use Case: Identify if a server has started executing new, unexpected processes or command-line patterns over time, which could signal a slow-moving compromise or a misconfigured automation script.

Quick Start

Investigate process drift on the device named 'WEBSRV-01' over the last 7 days.