Q9 · Host detect 2

← Question library

Preserved graph release · 0.20260206e

Is endpoint execution and persistence activity present in collected evidence related to control-plane actions?

Question ID

Q9

Category

Host

Archetype

detect

Declared entry point

Yes

The wording and classification above are preserved from this release. It does not contain assessment criteria, applicability rules, investigation-specific context, or evidence for this question. Those must not be inferred from the graph alone.

Recorded outgoing routes

• yes
  Q151 · Have investigators confirmed that endpoint execution and persistence activity in api invocation patterns is authentic telemetry?

  Route ID: Q9-yes-Q151

• no
  Q284 · Were upstream and downstream dependencies for cloud control-plane and workload activity in network pivots included in scope?

  Route ID: Q9-no-Q284

• unknown
  Q10 · Is network session and transport activity present in collected evidence related to transport metadata?

  Route ID: Q9-unknown-Q10

These links show the graph's published routing. Following a link does not record an assessment or authorize an action.

Cite this exact question

Include the question ID, graph version, and source digest so that later revisions cannot silently change the reference.

TENSOR Framework, graph 0.20260206e, question Q9: “Is endpoint execution and persistence activity present in collected evidence related to control-plane actions?” https://tensor-standards.pages.dev/questions/0.20260206e/Q9/

Source SHA-256

dfc3f1a965c01b6f7ade253e426e69abcbad688fab20d9d00065d71c777c010c

Download the exact graph · Pinned repository source

Using this question in the candidate Core

This preserved entry is not a converted Core 0.1.0-draft.1 definition. A reviewed conversion must supply explicit assessment criteria and parameters, preserve the source identity, and document any change in meaning. See the candidate contract and contribution process.