Glossary
EDR
Endpoint Detection and Response is agent-based tooling that records endpoint activity, detects malicious behaviour and allows remote containment.
Updated 2 Sept 2026
In detail
EDR differs from traditional antivirus in what it watches: instead of matching files against signatures, it records process creation, command lines, registry and file changes, and network connections, then evaluates that behaviour. The recording is what makes investigation possible after the fact, and the response capability — isolate host, kill process, collect artefacts — is what makes containment fast.
Why it matters
Most intrusions today involve legitimate tools used maliciously, which signature scanning cannot separate from normal use. Behavioural telemetry can. EDR is also the highest-value single feed into a SIEM, because endpoint process lineage explains what an identity or network alert only hints at.
Examples
- Flagging a Word process spawning PowerShell with an encoded command — a classic macro-delivery pattern.
- Isolating an infected laptop from the network while keeping the agent's management channel open.
- Reconstructing which files a ransomware process touched before it was stopped.