EDR

EDR — Endpoint Detection and Response

Detection · Intermediate

Software on endpoints that records activity such as processes and network connections and lets responders investigate or isolate a host.

It is more than a signature scan. It keeps a history of what a laptop ran so an analyst can see a suspicious process and isolate that one machine.

Example: A responder isolates a laptop after the endpoint record shows a script launching a tool the user never installs.

Common misconception

It does not replace patching or backups. It improves visibility and response on the endpoint.