Threat intel requires analyzing raw data about cyber threats, attacker behavior, and indicators such as IP addresses, malware, and IOCs to produce actionable insights. Telemetry is the raw version of this data before analysis. Telemetry is automated data collected from devices and systems about their behavior, performance, and activity, transmitted to a central system for analysis.
To support strict data‑privacy needs, SYNERGIX LEDR forwards Security and Sysmon events directly from Windows clients and Active Directory Domain Controllers exclusively to the customer’s own Azure tenant—ensuring log data remains fully under customer control and is never stored elsewhere.
Once ingested into Azure Log Analytics Workspace, customers can immediately leverage built‑in KQL queries to detect various attacks, such as Kerberoasting activity, and create additional custom KQL searches to identify other potential threats across their environment.
