What kind of information and visibility do I actually get from Hexnode XDRSolved

Hi @mortimer,
That is a great question. You will definitely get much more than basic alerts. Hexnode XDR is designed to give you both a bird’s-eye view of your entire environment and deep forensic data for individual endpoints.

Here is a breakdown of the exact information you can pull from the platform:

1. The Big Picture (XDR Dashboard)

When you first log in, the Dashboard gives you a top-down view of your security posture.

• Incident Landscape: You will see the total number of incidents, open threats, alerts, and exactly how many vulnerable devices you have.
• MITRE ATT&CK Mapping: It categorizes threats into specific tactics (like Initial Access, Execution, or Lateral Movement) so you understand exactly what the attacker is trying to achieve, the motive of the attack, or the pattern to identify points of compromise and threat entry points in your device fleet.
• Remediation Trends: You can see a breakdown of how threats are being handled, such as what percentage of files were Quarantined, processes Deleted, or devices Isolated.

2. Granular Threat Data (Incidents Tab)

When a specific threat triggers an alert, the platform gives you the complete “Who, What, Where, and How” so you can investigate effectively. In addition to that, the Incidents tab provides you the following valuable insights

• Endpoint & User Data: You will see the Host Name, local and external IP addresses, and the specific active user session (including their Windows Security Identifier) at the time of the event.
• The Process Lifecycle: This is where you get your forensic data. XDR logs the exact file path, the executable hash, and the precise command line script used to launch the malicious process.
• Process Tree: You get a visual map of the threat. It shows the parent process and every child process it spawned, making it incredibly easy to trace the root cause.

3. Proactive Hunting (Investigate Tab)

You do not have to wait for an alert to gather information. The Investigate tab allows you to run advanced custom queries across your entire network. You can search for and view:

• File & Script Activity: File creations, modifications, and specific PowerShell or command-line script executions.
• Network & Host Activity: IP communications, DNS activity, WMI events, and Registry modifications.
• Every search result provides the exact timestamp, endpoint, user, process name, and technical attributes like thread IDs.

If you have any other questions, let me know.

Regards,
Eden Pierce
Hexnode