EDR (Endpoint Detection and Response)
Definition
An agent-based security tool deployed on individual endpoints (workstations, servers, mobile devices) that monitors process execution, file changes, network connections, and registry activity in real time. Examples include CrowdStrike Falcon, Microsoft Defender for Endpoint, and SentinelOne.
- Deployment
- Agent-based, on individual endpoints
- Monitors
- Process execution, file, network, registry activity
- Examples
- CrowdStrike Falcon, Defender for Endpoint, SentinelOne
- Timing
- Real-time monitoring and response
Common questions
How does EDR differ from traditional antivirus?+
Antivirus mainly matches files against known malware signatures at rest or on execution, while EDR continuously records endpoint behaviour and lets analysts hunt for and reconstruct an attack sequence after the fact, even for threats that had no prior signature.
What forensic value does EDR telemetry add to an investigation?+
It typically preserves process trees, command-line arguments, and network connections tied to a specific timestamp on the host, which lets investigators reconstruct an intrusion timeline in far more detail than disk artefacts alone usually allow.
Related terms
- SIEM (Security Information and Event Management)
- A platform that aggregates log and event data from systems, networks, and applications across an environment, correlates events against detection rules, generates...
- Alert Correlation
- The process of grouping multiple related events or alerts into a single higher-level alert representing one attack sequence. A correlation rule might...
- Alert Fatigue
- The condition in which analysts receive more alerts than they can meaningfully review, leading to delayed responses, dismissed true positives, and reduced...
- IDS/IPS (Intrusion Detection/Prevention System)
- Network or host-based systems that inspect traffic or system calls for known attack patterns. An IDS generates alerts without blocking; an IPS...
- Indicator of Compromise (IoC)
- An observable artefact that suggests a system has been involved in a malicious event. Static analysis produces file-based IoCs: cryptographic hashes, embedded...
- MTTD / MTTR
- Mean Time to Detect and Mean Time to Respond: the two primary operational KPIs for a SOC. MTTD measures the gap between...
- SOAR (Security Orchestration, Automation, and Response)
- A platform that receives alerts from the SIEM and other sources, executes automated playbooks to enrich and triage them, and integrates with...
- STIX / TAXII
- Structured Threat Information eXpression (STIX) is a standardised language for describing threat intelligence objects. Trusted Automated eXchange of Intelligence Information (TAXII) is...
- Threat Intelligence Platform (TIP)
- A system that ingests indicator feeds from external providers and internal sources, deduplicates and scores them, and exports curated indicators of compromise...
Explained in these topics
- Detection Sources and Alert Pipelines
- SOC Tooling and the SIEMAn agent-based technology that records detailed endpoint telemetry (process trees, file writes, network connections, registry changes) and stores it for retros...