What is EDR?
Endpoint detection and response (EDR) is a category of security software built for the endpoints themselves: desktops, laptops and servers. A lightweight agent on each device continuously records what happens on it and sends that telemetry to a central console, which is usually cloud-hosted. Analysts and automated rules use the data to spot attacks, investigate how they happened and respond from the same console.
How EDR works
- Record: the agent logs process launches with their command lines and parent processes, file and registry changes, network connections, user logons and script activity.
- Detect: instead of relying only on signatures of known malware files, EDR looks for suspicious behavior. Examples include an Office document launching PowerShell, a process reading credentials from memory, rapid encryption of many files (typical of ransomware) or a new service created from a temp folder.
- Investigate: the console shows a timeline and process tree, so an analyst can trace an alert back to the attachment or download that started it and see which other machines show the same indicators.
- Respond: remote actions such as isolating the host from the network while keeping its connection to the console, killing a process, quarantining or deleting a file, collecting forensic data or opening a remote shell for cleanup.
EDR compared with antivirus
| Traditional antivirus | EDR |
|---|---|
| Focuses on blocking known malicious files | Assumes some attacks will get through and records activity to find them |
| Mostly signature-based scanning | Behavior analytics, threat intelligence and threat hunting |
| Little visibility after an infection | Detailed history for investigation and root-cause analysis |
| Cleans or quarantines a file | Contains an entire host and responds across many endpoints |
Many current products combine next-generation antivirus and EDR in one agent. Microsoft Defender for Endpoint, for example, adds EDR capabilities on top of the Microsoft Defender Antivirus built into Windows.
EDR, XDR, MDR and SIEM
- EDR covers endpoints only.
- XDR extends detection and response to other sources such as email, network, cloud and identity, and correlates them into single incidents.
- MDR is a service, not a product: an outside team of analysts watches and responds to EDR or XDR alerts for you.
- SIEM collects and correlates logs from almost any system, but response usually happens in other tools.
EDR in daily support work
A help desk technician may meet EDR when a user reports that a laptop suddenly has no network access because the security team isolated it. Technicians also deploy the EDR agent on new machines, confirm it stays updated and make sure users cannot disable it. Because the agent watches behavior, legitimate admin scripts sometimes trigger alerts. Those are reviewed and excluded by the security team, not handled by turning protection off.
EDR on the CompTIA A+ exam
EDR is on the shared A+ acronym list and is Core 2 security material. Know the difference between prevention by signature and detection plus response.
- If a question describes software on workstations that monitors behavior, detects threats that antivirus missed and can remotely isolate an infected computer, think EDR.
- If the data comes from endpoints, email and cloud together, think XDR.
- If a third-party company supplies the analysts, think MDR.
- If the question only asks about scanning for known viruses with definition updates, think antivirus.