Endpoint Detection & Response (EDR)

Overview

EDR continuously monitors endpoint devices for suspicious activity, since many attacks play out directly on endpoints — malicious processes, credential theft, privilege escalation, persistence, and ransomware behavior.

Key concepts

Endpoint telemetry, EDR agents, process trees
Quarantine, host isolation, containment, remediation
EDR vs. IDS/IPS trade-offs

How it works

EDR (Endpoint Detection and Response) continuously monitors endpoint devices — laptops, desktops, servers, VMs — for suspicious activity. It collects detailed endpoint telemetry and helps teams detect, investigate, contain, and respond to threats. It matters because many attacks happen directly on endpoints: malicious processes, suspicious commands, credential theft, privilege escalation, persistence, and ransomware behavior.

An endpoint is any device connected to an organization's network that users or services interact with — Windows laptops, macOS computers, Linux systems, servers, VMs, mobile devices, cloud-hosted servers, POS systems, and specialized business devices.

Core EDR terms

Term	Meaning
Endpoint telemetry	Security-relevant data from an endpoint — processes, files, logins, registry changes, command-line activity, network connections.
EDR agent	Software installed on an endpoint that collects telemetry and may take security actions.
Process / Process tree	A running program instance, and the record of which process started which — helps analysts trace relationships.
Command line	The text-based command used to launch a process or execute an action.
File hash	A unique value from a file's contents, used to identify known malicious or known-safe files.

Response actions

Term	Meaning
Quarantine	Isolating a suspicious file so it can't run or affect the system.
Host isolation	Restricting an endpoint's network communication so it can't spread malware or reach an attacker, while still allowing investigation.
Containment	Actions taken to limit the impact and spread of an incident.
Remediation	Removing malicious artifacts, fixing weaknesses, restoring systems, and preventing recurrence.
Rollback	Restoring files or settings to an earlier known-safe state, when supported by the platform.
Living off the land	An attacker technique abusing legitimate built-in tools instead of installing obvious malware.

EDR vs. IDS/IPS

EDR platforms are advanced and often look across entire networks for a chain of attacker activity rather than a single computer — giving visibility into large-scale attack patterns beyond one machine, but at higher cost and with less focus on any single endpoint in isolation. IDS/IPS tools are more rudimentary — they protect a single computer from a known signature, making them very effective at stopping known signatures before they take root, but they do little to identify large-scale attack patterns.