PowerShell Incident graphs in EDR do not have the expected MITRE-enriched nodes in the process lineage
Article ID: 190371
Endpoint Detection and Response
When reviewing PowerShell incidents in the EDR section of CDM, you are expecting to see MITRE-enriched neighbors in the lineage graph. All other types of Incidents have this process lineage and MITRE-enriched data for each node.
These additional nodes are collected and associated with the lineage because they're important for analysis and investigation. These are expected for all other Incidents with lineage, except for PowerShell incidents.