Back to glossary

Endpoint Detection and Response

A security solution that continuously monitors end-user devices to detect and respond to cyber threats like ransomware and malware.

AbbreviationEDR
Categorysecurity

Overview

EDR goes beyond traditional antivirus by focusing on behavioral analysis and real-time visibility. It records endpoint activities and uses advanced analytics to identify suspicious patterns that may indicate a breach.

Key Capabilities

  • Continuous Monitoring: Tracking all processes, network connections, and file changes.
  • Threat Hunting: Proactively searching for signs of advanced persistent threats (APTs).
  • Incident Response: Providing tools to isolate infected devices and remediate threats.

Importance

EDR is critical for detecting 'fileless' attacks and other sophisticated techniques that bypass traditional defenses.

Related Terms

Endpoint SecurityManaged Detection and Response