Overview
EDR (Endpoint Detection and Response) gives the SOC deep visibility into endpoint activity. This lesson introduces EDR concepts.
Learning objectives
- Define EDR and its capabilities.
- Distinguish EDR from traditional antivirus.
- Connect EDR to endpoint detection and response.
Core concept
Endpoint Detection and Response (EDR) is technology that continuously monitors endpoint activity (processes, files, network connections, registry/system changes), detects suspicious behavior, and enables response (investigation and containment) — all with rich telemetry. It goes beyond traditional antivirus (which mainly matches known-malware signatures) by emphasizing behavioral detection (module 8) and providing deep visibility and response capabilities: recording detailed endpoint telemetry for investigation, detecting behavioral indicators of attack, and letting analysts contain a host (e.g. isolate it) remotely. EDR is the SOC's primary endpoint-layer tool, complementing network detection (IDS) and log/SIEM analysis. It embodies the behavioral-detection and safe-response concepts from earlier modules, applied at the endpoint.
How it works
An EDR agent on each endpoint continuously records telemetry — process launches (and parent-child relationships), file operations, network connections, registry/system modifications, and more — and streams it to a central platform. On this data it performs behavioral detection (module 8): flagging suspicious behaviors (injection, persistence, anomalous connections, mass file changes) rather than relying only on signatures, so it catches novel/modified malware. It provides analysts deep visibility for investigation — notably the process tree (next lesson) reconstructing what happened — and response actions: isolating a host from the network (containment), killing processes, or collecting artifacts, often executed remotely from the console. Compared to traditional antivirus (signature-focused, limited visibility/response), EDR's combination of behavioral detection, rich recorded telemetry, and response makes it central to modern endpoint security. It feeds alerts to the SIEM for correlation and is the endpoint counterpart to network IDS — together providing defense in depth. EDR telemetry is also the basis for endpoint threat hunting (module 16).
Practical example
A SOC uses EDR across its endpoints. On one host, traditional signature matching finds nothing (the malware is a novel variant), but the EDR's behavioral detection flags suspicious activity: a process injecting into another and creating persistence. The analyst uses the EDR's visibility — the recorded process tree and telemetry — to investigate what happened, then uses EDR response to isolate the host from the network (containment) remotely, stopping spread while preserving it for analysis. This — behavioral detection, deep visibility, and remote containment on one platform — shows why EDR goes well beyond traditional antivirus and anchors the SOC's endpoint-layer defense.
Cybersecurity relevance
EDR is the SOC's primary endpoint-layer tool, going beyond signature-focused antivirus by combining behavioral detection (module 8 — catching novel/modified malware), deep recorded telemetry/visibility for investigation (the process tree and more), and response capabilities (remote host isolation/containment). It's the endpoint counterpart to network IDS (module 11) and log/SIEM analysis, together forming defense in depth, and feeds alerts to the SIEM for correlation. EDR embodies the behavioral-detection and preserve-while-contain concepts from earlier modules, applied at the endpoint, and underpins malware-alert investigation (module 8) and endpoint threat hunting (module 16). Understanding EDR frames this whole module (process trees, persistence, containment, telemetry).
Common mistakes
- Equating EDR with traditional antivirus (missing its behavioral detection, visibility, and response).
- Underusing EDR's response capabilities (e.g. not isolating a compromised host).
- Ignoring the rich telemetry EDR provides for investigation and hunting.
Key takeaways
- EDR continuously monitors endpoint activity (processes, files, connections, system changes), detects suspicious behavior, and enables response (investigation, remote containment).
- It goes beyond signature-focused antivirus with behavioral detection (catching novel/modified malware), deep recorded telemetry/visibility (e.g. process trees), and response actions.
- EDR is the SOC's endpoint-layer tool (counterpart to network IDS), feeds the SIEM, and underpins malware investigation and endpoint threat hunting — anchoring defense in depth at the endpoint.
Check your understanding
- How does EDR differ from traditional antivirus in detection, visibility, and response?
- What endpoint activity does EDR record, and how does that support detection and investigation?