What feature is used to get a comprehensive picture of infected endpoint activity?

The Process View feature in Symantec Endpoint Detection and Response (EDR) provides a detailed

and comprehensive view of activities associated with an infected endpoint. It displays a graphical

representation of processes, their hierarchies, and interactions, which helps security teams

understand the behavior and spread of malware on the system.

Advantages of Process View:

Process View shows the relationship between different processes, including parent-child structures,

which can reveal how malware propagates or persists on an endpoint.

This visualization is instrumental in tracking the full impact of an infection, helping administrators

identify malicious activities linked to specific processes.

Why Other Options Are Less Suitable:

Entity View is more focused on broader data relationships, not specific infected process activities.

Full Dump and Endpoint Dump refer to memory or system dumps, which are useful for in-depth

forensic analysis but do not provide an immediate, clear picture of endpoint activity.

Reference: Process View is designed within EDR for tracking endpoint infection paths and behavioral

analysis​.