Security · Detection & Response
EDR
Endpoint Detection and Response continuously records endpoint behaviour, detects malicious activity, and enables remote investigation and containment.
IntermediateUpdated 2026-09-01
Overview
EDR replaced signature only antivirus with behavioural telemetry: process trees, command lines, file and registry activity, network connections, script block logging and memory events. Detection focuses on techniques rather than known files.
Its response capability is what makes EDR operationally decisive, isolating a host from the network, killing a process, collecting a forensic package or running a remediation script within minutes of detection.
How it works
- 01A kernel and user mode agent streams events to a cloud analytics backend, which applies detection models and threat intelligence.
- 02Detections are grouped into incidents with an attack timeline, mapped to ATT&CK techniques.
- 03Analysts respond in place: network isolation, live response shell, indicator blocking, and automated remediation playbooks.
- 04Coverage and health monitoring matters as much as detection, an unenrolled or unhealthy agent is a blind spot.
Reference table
| Capability | Scope | Primary strength |
|---|---|---|
| EDR | Endpoints | Deep behavioural detection and host containment |
| XDR | Endpoint, identity, email, cloud, network | Correlated cross domain incidents from one vendor's stack |
| SIEM | Any log source | Breadth, retention, custom detection and compliance reporting |
| SOAR | Workflow across tools | Automation, enrichment and consistent response |
Security considerations
- Enable tamper protection and require MFA plus role separation for console access.
- Monitor for agents that are missing, offline or in reduced functionality mode.
- Tune exclusions carefully, broad path exclusions are a favourite attacker abuse target.
- Practise the isolation workflow before an incident; hesitation costs containment time.
Common misconfigurations
- Running in audit only mode long after deployment.
- Excluding entire drives for application performance reasons.
- Servers and virtual desktops left out of scope.
- Alerts routed to an unmonitored mailbox rather than a queue with ownership.