Attackers are targeting endpoints more than ever, due to the proliferation of multiple devices, users and entities across the enterprise. While security teams can leverage endpoint telemetry as a rich data source to detect advanced attacks, they often lack the ability to link this activity to a user. Techniques such as lateral movement, credential compromise and privilege abuse are difficult to detect using endpoint data alone when access appears legitimate. And even after a threat is detected, analysts must spend precious time investigating an incident to understand the scope and severity before being able to confidently and completely take steps toward remediating the detected threat.