EDR (endpoint detection and response)
endpoint detection and response · XDR · extended detection and response · next-generation antivirus · NGAV · EPP
Software installed on computers and servers that watches their behaviour, detects malicious activity and lets defenders isolate or clean up a machine remotely.
In practice
Traditional antivirus recognises known files; an EDR watches behaviour: a word processor launching a command interpreter, a process encrypting hundreds of files in a minute. It records activity for investigations and can cut a machine off the network in one click. XDR extends the same logic beyond endpoints (email, network, cloud, identities) to correlate signals. An EDR with nobody reading its alerts offers little protection, so it usually comes with a SOC or an MDR service.
Fictional case: on an assistant’s laptop, the EDR detects that a document opened from an email is trying to download a program. It blocks the process, isolates the laptop and sends the alert to the SOC, which finds and deletes the same email in ten other mailboxes.
