Network Guardian: Lateral-Movement Indicators and Context

Lateral-movement investigations need source/destination context, timestamps, identities, and an explanation of the observed technique.

Network Guardian includes checks for supplied network and authentication-related indicators. Use the evidence in an alert to scope the affected hosts and relevant administrative activity.

A technique label is not an incident verdict or universal coverage. Test representative malicious and benign administration events and verify the response independently.

Check collector wiring, the current event schema, and the enforcing component before relying on a response. Preserve the original event and verify the result on your actual deployment. An emitted alert does not prove that the initiating operation was stopped.