Generic Endpoint Telemetry Collection for Hosts

Shadows VMB@Vemorian_Mort

•updated Jul 8, 2026•1•0•29

This rule retrieves a collection of raw telemetry events including process, file, registry, and network information for a specific host (ex. HostName123). It acts as a diagnostic or hunting query to list the most recent 5,000 activities performed on the specified machine.