Zero Trust Engineering — Endpoint detection and response

/02 About

Devices and endpoints engineering reference for endpoint detection and response, including policy, logical interfaces, recovery and assurance.

Purpose: Endpoint detection and response. Domain: Devices and endpoints. Family: assurance. Scenario trigger: Receive endpoint threat behavior signal. Input assurance: Process telemetry, process ancestry and signed detector context. Evaluation: Correlate endpoint indicators with enterprise threat intelligence. Governing policy: Endpoint detection accuracy and response authority policy. Resource-side obligation: Launch scoped containment and forensic acquisition. Protected concern: Endpoint security response plane. Logical interface: Endpoint process lineage detector severity action and evidence hash. Evidence: Process evidence, detections and operator approvals. Failure: Tampered telemetry or malicious process persistence. Required recovery: Isolate affected device and preserve chain of custody. Architectural invariant: Response controls must avoid unbounded privilege and preserve trusted evidence Adoption: replace reference roles with concrete owner-controlled services. Specify exact provider/consumer identities, schema fields and classifications, signal provenance and freshness, idempotency, authorization lifetime, timeout/retry limits, observation and tamper evidence. A denied or failed operation must not silently become a permitted one. Scope: original vendor-neutral, implementation-agnostic technical reference model. Illustrative logical components and behaviors are neither a deployed system nor evidence of regulatory compliance. Package identities remain stable within the package; cross-package semantic reconciliation requires separate explicit registry support.

Curated · other · unspecified · Published by Lattix · 29 elements · 33 relationships · validated on publish