WEBVTT

00:00:00.640 --> 00:00:01.450
Finally,

00:00:01.460 --> 00:00:05.980
let's take a look at user‑mode services. This service is usually

00:00:05.980 --> 00:00:09.790
responsible for consolidating all the telemetry from the different

00:00:09.790 --> 00:00:13.990
data sources we covered previously, such as the kernel‑mode drivers,

00:00:14.000 --> 00:00:17.850
API monitoring components, and ETW data feeds.

00:00:18.440 --> 00:00:22.550
It will also be responsible for orchestrating the antivirus activities.

00:00:23.140 --> 00:00:26.620
It will trigger scans and, in some cases, perform automated

00:00:26.620 --> 00:00:29.460
file analysis using artificial intelligence.

00:00:30.240 --> 00:00:35.270
It will be responsible for sending files and scripts to emulators and sandboxes,

00:00:35.570 --> 00:00:39.350
as well as sending some of the telemetry to the cloud so that it can be

00:00:39.350 --> 00:00:43.350
correlated with indicators of compromise and reputation services.