A PowerShell process, temporary script, scheduled task registration, and connection to an unfamiliar address might individually be explainable, but their combined context changes the investigation. Understanding the relationships between these actions reveals potential malicious activity that individual events might miss. Legitimate tools can be used for malicious purposes, making their names alone insufficient for settling an investigation; instead, relationships between processes, files, and connections are crucial. Automated analysis, especially through behavioral graphs connecting processes, files, and network destinations, helps preserve evidence and contextualize activities. Such graphs transform basic event records into a comprehensive narrative, detailing who launched what, which process wrote a script, and what an outbound connection was associated with. This contextual understanding helps distinguish routine administration from suspicious behavior, even when similar tools are used. While existing correlation rules address some relationships, a more effective system would preserve surrounding behavior beyond prewritten sequences. Logster, for instance, uses an LLM to evaluate serialized activity graphs, offering contextual assessment and structured results for security teams. This approach allows analysts to start investigations with an assembled account of activity, rather than manually reconstructing disparate logs. However, any verdict is bounded by the collected evidence, and limitations like activity window size, missing telemetry, and model input constraints can impact accuracy. Therefore, a practical evaluation should compare suspicious sequences with legitimate workflows using similar tools, focusing on how the system distinguishes them. Ultimately, a useful endpoint detection system should simplify the investigation process by providing organized, contextualized evidence, allowing analysts to verify conclusions more efficiently.