Cybersecurity glossary
What is Endpoint Detection and Response (EDR)?
Learn what Endpoint Detection and Response (EDR) is, how endpoint telemetry reveals attacker behavior, how isolation and forensics work, and where EDR fits beside antivirus, SIEM, and XDR.
Definition
Endpoint Detection and Response (EDR) is a security capability that continuously records endpoint activity—processes, files, network connections, and identity context—then detects suspicious behavior, supports investigation, and enables response actions such as isolating a host or killing a process.
Why the endpoint is still where attacks become real
Phishing, stolen tokens, and vulnerable apps often start elsewhere. Execution, persistence, and ransomware still land on a host. Endpoint Detection and Response (EDR) is the close-up camera on that host: not only “is this file known-bad?” but “what did this process spawn, touch, and talk to?”
Without that visibility, identity alerts describe a door opening while the room stays dark.
What EDR actually observes
Process and script activity
Parent-child trees, command lines, interpreters, and unusual living-off-the-land binaries.
File and persistence
Drops, modifications, scheduled tasks, services, and autoruns that survive reboot.
Identity on the host
Logons, token use, credential dumping patterns, and local privilege changes.
Network from the endpoint
Connections, DNS lookups, and beacon-like patterns the perimeter may never attribute to a process.
From telemetry to response
Record continuously
The agent streams or stores behavioral events even when no signature has fired yet.
Detect suspicious chains
Analytics score sequences (Office spawn, PowerShell encoded command, unusual child) rather than a single hash.
Investigate with context
Analysts pivot on the process tree, related hosts, and the same identity across time.
Contain the host
Isolation, process kill, or file quarantine stop spread while evidence is preserved.
Learn and tune
Confirmed techniques become custom detections; noisy admin tools get scoped exclusions.
EDR compared with nearby controls
| Control | Strength | Typical gap |
|---|---|---|
| Antivirus / NGAV | Known malware and some exploit prevention | Limited historical investigation of living-off-the-land |
| EDR | Host behavior, forensics, and isolation | Blind to activity that never touches the agent |
| XDR | Correlates endpoint with email, identity, and cloud | Quality still depends on the underlying sensors |
| SIEM | Long-term multi-source search and compliance | Weaker native host isolation than the EDR console |
- Measure real coverage: agent health, tamper protection, and unsupported OS exceptions.
- Prevent local admins from quietly uninstalling or pausing the sensor.
- Test host isolation and restore connectivity during incident drills—not for the first time in a breach.
- Retain enough endpoint telemetry to reconstruct a multi-week dwell, not only the last alert.
- Forward EDR detections into the SOC ticket flow with the process tree attached.
- Scope exclusions to publisher, path, and host group; never a global “disable PowerShell.”
- Cover jump hosts, CI runners, and privileged workstations first.
- Assume EDR-evasion exists: pair with identity and network detections for the same campaign.
The practical takeaway
EDR turns endpoints into explainable crime scenes instead of silent crash sites. Deploy it widely, protect the agent, and practice isolation—then correlate it with identity and cloud signals so attackers cannot hide in the layers the host never sees.
Related security terms
Extended Detection and Response (XDR)
Cross-domain detections that often consume EDR as one telemetry source.
Security Operations Center (SOC)
Team that triages EDR alerts and drives containment.
Incident Response
Uses EDR process trees and isolation during containment.
MITRE ATT&CK
Technique catalog commonly used to measure EDR coverage.
Runtime Application Self-Protection (RASP)
In-app runtime control that complements, not replaces, host EDR.
Frequently asked questions
What is EDR in simple terms?
It is a sensor on laptops, servers, and sometimes cloud workloads that watches what programs do, flags suspicious behavior, and lets responders freeze or inspect the machine.
How is EDR different from antivirus?
Classic antivirus focuses on known-bad files. EDR records behavioral telemetry—process trees, script activity, credential access—so it can catch living-off-the-land techniques that have no malware hash.
Does EDR replace a SIEM?
No. EDR is deep on the host. A SIEM correlates EDR with identity, email, cloud, and network logs that the endpoint agent never sees.
What response actions can EDR take?
Typical actions include isolating the host from the network, killing processes, quarantining files, collecting forensic artifacts, and remotely running approved investigation scripts.
Where does EDR fail?
Missing agents, outdated sensors, disabled tamper protection, unsanctioned devices, and attackers that operate only in identity or SaaS layers the agent does not observe.
Should servers and developer workstations both have EDR?
Yes if they can run a supported agent. Build machines and jump hosts are high-value targets; coverage gaps there are more dangerous than a missing agent on a locked-down kiosk.
How do teams keep EDR detections useful?
Tune exclusions carefully, map custom detections to ATT&CK, test isolation in drills, and feed EDR events into SOC workflows instead of leaving them in a vendor console silo.
References
Explore authoritative guidance and frameworks related to endpoint detection and response (edr).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.