EDR
Endpoint Detection and Response is agent-based tooling that records endpoint activity, detects malicious behaviour and allows remote containment.
Updated 2 Sept 2026
In more detail
EDR differs from traditional antivirus in what it watches: instead of matching files against signatures, it records process creation, command lines, registry and file changes, and network connections, then evaluates that behaviour. The recording is what makes investigation possible after the fact, and the response capability — isolate host, kill process, collect artefacts — is what makes containment fast.
Why EDR matters
Most intrusions today involve legitimate tools used maliciously, which signature scanning cannot separate from normal use. Behavioural telemetry can. EDR is also the highest-value single feed into a SIEM, because endpoint process lineage explains what an identity or network alert only hints at.
How it works
An agent on each endpoint streams telemetry to a cloud console where detection logic runs. Analysts pivot from an alert to the full process tree, see the parent process and command line, and act remotely. Managed variants (MDR) add a provider's analysts on top of the same telemetry.
Examples
- Flagging a Word process spawning PowerShell with an encoded command — a classic macro-delivery pattern.
- Isolating an infected laptop from the network while keeping the agent's management channel open.
- Reconstructing which files a ransomware process touched before it was stopped.
How it is detected or measured
Coverage is measured by agent deployment percentage, telemetry gaps (unmanaged or offline hosts), and detection results in ATT&CK-based evaluations.
Where this matters
- SOC Analyst
What a SOC analyst does hour to hour, the skills that get you hired, and the realistic route from tier 1 to detection engineering.
Sources
- MITRE ATT&CK Enterprise Matrix — MITRE
Behavioural techniques EDR detections are mapped against.