3.1Endpoint technologies

Sensors at the network boundary alone cannot see inside encrypted traffic or malicious actions carried in with valid credentials. That is exactly why you need visibility on the endpoint (host) itself. This section organizes the division of labor among three host-resident defenses—HIDS (monitoring host behavior, files, and logs), AV/antimalware (detecting/quarantining malicious code), and the host firewall (controlling traffic to/from that host)—and on what basis they decide something is "bad" (signature vs. behavior), from the perspective of an analyst reading alerts.

3.1.1Roles of host-resident defenses

• A HIDS (host-based intrusion detection system) monitors that host's system calls, process creation, file/registry changes, log tampering, and the like to detect suspicious behavior. Whereas a network IDS (NIDS) inspects packets on the wire, a HIDS watches the host's internal state, so it more readily catches execution occurring beyond encryption or post-compromise activity from within. Modern EDR integrates response/containment capabilities on top of HIDS.
• Antimalware/antivirus (AV) matches code in files or memory against known malware and, on a hit, quarantines/removes it. Traditional (legacy) AV centers on signature matching—strong against known samples but weak against unknown/variant ones. Next-generation AV (NGAV) additionally uses behavior/machine learning.
• A host firewall is the host's own packet filter, permitting/denying traffic to/from the host by port, protocol, or application (e.g., Windows Defender Firewall, Linux iptables/nftables). Whereas a network firewall guards the boundary, the host firewall protects each individual endpoint as a last line of defense and constrains internal lateral movement.

3.1.2Detection foundations: signature vs. behavioral/predictive

• Signature/rule-based detection fires when input matches predefined known characteristics—a hash, byte sequence, or known-malicious pattern. It yields few false positives with clear rationale, but misses unknown/zero-day threats or slightly altered variants (because no signature exists yet).
• Behavioral/predictive (predictive AI) based detection flags deviation from a normal baseline or a chain of actions typical of malice (e.g., a document app launching PowerShell and connecting outbound). It can react to unknown threats, but tends to produce more false positives when legitimate work looks similar. Predictive AI/machine learning is an advanced form of this behavioral approach.

In the SOC you are triaging two notifications that fired simultaneously from one business PC. One is an AV alert—"detected and quarantined the known trojan Trojan.GenericKD"; the other is a HIDS/EDR behavioral alert—"winword.exe spawned a child process powershell.exe -enc <Base64> and attempted a connection to an external IP." Jumping to "the AV quarantined a known item, so it is handled, and the HIDS alert is probably a false positive" is a dangerous call. The AV signature hit only stopped that one sample, whereas winword.exe (a document app) launching obfuscated PowerShell to reach out is a sign of an unknown/variant payload or fileless execution not yet in any signature—precisely what behavioral/predictive detection exists to catch. The sound judgment treats the HIDS alert as leaning true-positive: isolate the endpoint and preserve the process tree, destinations, and dropped files. Conversely, a setup with only AV and no behavioral monitoring misses exactly this "document macro -> obfuscated script -> external C2" chain because no signature exists—that is how "legacy AV is strong on known, weak on unknown" shows up in practice. From the host-firewall angle, blocking this endpoint's outbound traffic to unfamiliar destination ports means that even if execution slips through, C2 establishment and lateral movement are constrained at the last line of defense. Telling which technology raised an alert and on what basis is the key to avoiding both underreaction (missing the unknown) and overreaction (over-reacting to a false positive).

3.1.3Section summary

• HIDS/EDR watches host-internal behavior, AV watches malicious code, and the host firewall watches traffic to/from the endpoint—supplying visibility that boundary sensors lack
• Signatures/rules are strong on known and weak on unknown; behavioral/predictive AI reacts to the unknown but raises false positives—the two are complementary
• Read alerts by "which technology fired and on what basis"—do not rest on an AV known-quarantine alone, and do not miss the post-compromise activity in a behavioral alert