What is EDR (Endpoint Detection and Response)?
D4 · Operations · CompTIA Security+ SY0-701EDR (Endpoint Detection and Response) is a security solution that continuously monitors endpoints (laptops, servers, mobile devices) for suspicious behavior, providing real-time detection, investigation, and automated response capabilities.
EDR capabilities: process monitoring, file system monitoring, network connection tracking, behavioral analysis, threat hunting, automated isolation.
EDR vs. traditional AV: AV uses signature-based detection (known threats). EDR uses behavioral analysis (detects unknown/fileless threats).
EDR capabilities: process monitoring, file system monitoring, network connection tracking, behavioral analysis, threat hunting, automated isolation.
EDR vs. traditional AV: AV uses signature-based detection (known threats). EDR uses behavioral analysis (detects unknown/fileless threats).
EDR evolved from AV. XDR (Extended Detection and Response) extends EDR across network, email, and cloud. MDR = outsourced EDR monitoring. Key advantage of EDR: detects fileless malware and living-off-the-land attacks that bypass signature-based AV.