Endpoint Detection and Response technology have changed how security teams investigate incidents by increasing the available data. In this session we look at how this trend has continued by demonstrating collection of network and application logs while performing event correlation using a mixture of freely available tools.