Which log source is needed to expand detection coverage when using curated detections and YARA-L rules on Windows endpoints?

• A. Windows Sysmon.
• B. Microsoft Entra ID.
• C. Windows PowerShell.
• D. Windows Procmon.

Answer: (A)

Expanding detection coverage on Windows endpoints with curated detections and YARA-L rules relies on richer, consistent endpoint telemetry. Windows Sysmon provides detailed, structured event data—such as process creation, file and registry activity, and network connections—that goes beyond standard Windows logs. This deeper telemetry gives detection rules more attributes to inspect and enables broader coverage for both curated detections and YARA-L indicators, improving accuracy and detection opportunities. In contrast, cloud identity logs from Microsoft Entra ID don’t feed endpoint telemetry, PowerShell logs cover scripted activity but don’t offer the breadth of events Sysmon provides, and Procmon is a powerful live-debugging tool not suited for scalable, long-term production telemetry needed for detections.