EDR
noun · also Endpoint detection and response
Security software on laptops and servers that records process, file and network activity, detects malicious behavior and lets analysts respond.
Endpoint detection and response (EDR) goes beyond classic antivirus. Antivirus mostly asks "is this file known to be bad?". EDR continuously records what happens on the device (which processes start, what they connect to, which files and registry keys they touch) and looks for behavior that matches attacker techniques, even when every individual file is legitimate.
It also gives the SOC remote hands on the machine: isolate it from the network, collect an investigation package, kill a process or run a scan.
Example
An Office document spawns PowerShell, which downloads and runs an encoded script. None of these files may be flagged as malware, but the chain of behavior is suspicious, and the EDR raises an alert showing the full process tree. Microsoft Defender for Endpoint, CrowdStrike Falcon and SentinelOne are common EDR products.
Why it matters for a SOC analyst
Most incident investigations end up on an endpoint. Reading a process tree, understanding parent and child processes, and knowing when to isolate a device are core skills. In Microsoft Defender XDR, EDR data is queryable in advanced hunting through tables such as DeviceProcessEvents and DeviceNetworkEvents.
Articles that use this term
Certifications · · 3 min read
SC-200 study plan for SOC beginners
A six-week plan to prepare for Microsoft's Security Operations Analyst exam: what to study each week, how to practice for free, and the KQL you need to know.
Related terms
- XDR
A security platform that correlates detections from endpoints, identities, email, cloud apps and more into single incidents with a shared response console.
- Malware
Any software designed to harm a system or its users, such as viruses, worms, trojans, ransomware, spyware and infostealers.
- Living off the land
Attacking with tools already present on the victim's systems, such as PowerShell or WMI, so the activity blends in with normal administration.
- Lateral movement
The techniques attackers use to move from the first compromised system to other systems and accounts inside a network.
- Indicator of compromise
An observable artifact, such as a file hash, IP address, domain or registry key, that suggests a system may have been compromised.
- SIEM
A platform that collects logs from across an organization, correlates them and raises alerts, giving the SOC one place to investigate.