Skip to main content

Activity map

The Activity map shows what happened on one endpoint over time: a lane per data type, the process tree around any process, and that process's events. It reads the endpoint's local event store, so it can go back as far as retention allows, and it can follow the endpoint live.

It is part of Investigate and appears where Investigate is enabled.

Open the activity map​

  • On an endpoint's page, open the Activity map tab.
  • From a timeline row, a look-back hit, a hunt match or a detection, click Activity map (or Open activity map). The map opens on that endpoint's page, centred on the process and the moment you came from.
  • Endpoints › Investigate › Activity map asks you to choose an endpoint, then opens its tab.

The link carries the process and time (?tab=activity-map&guid=…&at=…), so you can share it with someone who has access to the fleet.

Swimlanes​

The top of the map counts events per data type over time: Process, Network, File, Login, Persistence, Scout action and Detection.

  • Pick a window: 15 m, 1 h, 6 h, 24 h or 7 d. Opened from an event, the window is the hour around it.
  • Drag across the lanes to zoom into a span. Zoom out goes back one step.
  • Click a bar to list that bucket's events, for that data type, in Events below. Show all clears the selection.

If the endpoint hasn't answered in full, a note says the counts are partial. Click Ask again.

Process flow​

Pick an event that has a process, in Events or in the timeline, to map its process tree: its parents up to the root and a few generations of children.

Each process shows its name and pid, the user, when it started and ended, small counts of its events by type, and a red mark with the number of detections. Click a process to open its panel.

  • +N on a process loads more of its children.
  • Flat draws the tree as cards. Isometric draws it as a 3D view, with the root at the bottom right and the tree rising to the top left. Labels stay upright, a red ring marks a detection, and hovering shows the details. Click, select, expand and pan or zoom work the same in both. Zoom to fit fits the tree to the view.
  • Activity is the legend for the event colours.

If the endpoint hadn't answered in full, or the tree hit its size limit, a note says so. Ask again reads it again; +N loads the rest of a branch.

Wide trees​

A parent with many children, such as a web server or a shell loop, shows its first 12 children. The rest are grouped by program, as a stack labelled with the count and the name (for example 388 × ssh), with a small chart of when they started, how many are still running and any detections.

Click a stack to open its list. It loads 100 children at a time as you scroll.

  • Search by pid, user or command line.
  • Only program lists the children running that program; switch to All children for every child of the parent.
  • Map re-centres the map on that child.

The process panel​

The panel shows the selected process's Path, Command, SHA-256, user, start and end, and its Children. Below that come its events, grouped by data type. The map shows a few events per process; the panel loads the selected process's full list. If the endpoint hadn't answered in full, the panel says there may be more events.

  • Map from here re-centres the map on this process.
  • Open in timeline opens the endpoint's Event timeline around the process's start.

Live mode​

Live mode adds events to the map as they happen. It needs an open live response session on the endpoint.

  1. If no session is open, the map shows Live streaming needs a live session. Click Start live response.
  2. Switch on Live.

The window moves to the last 15 minutes and new events arrive every 2 seconds. They are added to the swimlanes, the tree and Events, and new processes are highlighted. The status shows how many events have arrived and when the last read was.

Switching Live off, or leaving the page, stops the stream. If the session ends, the status shows Session ended. If you have too many endpoint sessions open, the stream pauses until you close one (for example in Console).

Permissions​

The activity map runs queries on the endpoint, so you need to be allowed to run commands on the fleet's endpoints: an admin of the connection, or a Responder grant. See Investigate permissions.

Next steps​