← @kwm Twitter archive
Keith
@kwm
If you're working with endpoint products and have questions re: why a product did or did not see an event, it's helpful to understand what Minifilter Altitude is and how it works: https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/load-order-groups-and-altitudes-for-minifilter-drivers
1/3/2018, 10:35:56 AM
Favs: 9
Retweets: 3
linkKeith
@kwm
When dealing with Windows-based EDR visibility and capabilities, particularly relative to EPP products or the operating system itself, relative altitude can help to explain why things do or do not appear, work, etc.
Allocated Altitudes: https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/allocated-altitudes
1/3/2018, 10:41:21 AM
Favs: 9
Retweets: 4
link