English
Menu

What is EDR (endpoint detection and response)?

A security product that continuously records activity on endpoints such as PCs and servers, including process launches, changes to files and settings and network connections, detects suspicious behavior and supports investigation and response (isolating the device, stopping processes and so on). Unlike traditional antivirus software, which recognizes known malware files, it assumes that intrusions cannot be prevented completely and aims to find activity after an intrusion.

Japanese name: EDR(Endpoint Detection and Response)

EDR (endpoint detection and response) appears in 7 practice questions across 2 topics, including Cyber Attacks and Defense in Practice, Information Security Basics.

Field: Cyber Attacks and Defense in Practice

What it records

An agent installed on the endpoint records process launches and their parent-child relationships, command-line arguments, changes to files and settings, network connections, logons and more, and sends them to a management server. This makes it possible to trace a sequence afterwards, such as "a script was launched from an email attachment and communicated with an external host".

Detection and response

Detection uses rules matching known attack techniques, behavioral analysis and matching against threat intelligence. After a detection, actions such as remotely isolating the device from the network, stopping a process or quarantining a file can be taken from the console, so SOC analysts can quickly contain the spread of damage.

XDR and MDR

Products that analyze not only endpoints but also email, network, cloud and identity data together are called XDR (extended detection and response). Services that outsource EDR monitoring and analysis to a specialist provider are called MDR (managed detection and response) and are used by organizations that cannot staff a 24-hour team themselves.

Try it: questions about EDR (endpoint detection and response)

Which of the following correctly describes EDR (endpoint detection and response) compared with traditional antivirus software?

  1. AIt continuously records behavior on endpoints, such as process launches and network connections, detects suspicious activity and supports responses such as isolating the device
  2. BIt only checks whether files match the characteristics of known malware and deletes the files that match, without recording behavior
  3. CIt is placed at the network perimeter rather than on endpoints and blocks packets arriving from outside based on IP addresses and port numbers
Show answer and explanation

Answer: A. It continuously records behavior on endpoints, such as process launches and network connections, detects suspicious activity and supports responses such as isolating the device

Traditional antivirus software mainly compares files against the characteristics of known malware and aims to stop intrusion at the point of entry. EDR assumes that intrusion cannot be prevented completely and continuously records process launches, changes to files and settings, network connections and so on at the endpoint to detect suspicious behavior. Its features include going back through the records to investigate the intrusion path and the extent of the impact, remotely isolating the device from the network and stopping suspicious processes. Many products today provide antivirus functions and EDR in one.

FAQ

With EDR in place, is antivirus software unnecessary?

Their roles differ, so in many cases both are used. Antivirus software (EPP) stops known malware at the point of entry, and EDR finds and responds to attacks that get through. Many products today provide both functions in one.

Does installing EDR alone make us secure?

EDR is a tool that produces alerts and records, so people and procedures are needed to review them, decide and respond. Without a team that checks the alerts, response is delayed even when an attack is detected. If an in-house team is difficult, an external service such as MDR is used.

EDR (endpoint detection and response) in the explanations

Questions that mention EDR (endpoint detection and response) (7)

  1. Which of the following correctly describes EDR (endpoint detection and response) compared with traditional antivirus software?
  2. Which statement correctly describes a zero-day attack?
  3. An examination of the records of traffic on an internal network found the following traffic. Which of them most strongly suggests that malware is communicating with an external command server (C2 server)?
  4. The technique in which an intruder avoids using custom malware as far as possible and works with legitimate tools already present in the OS, such as PowerShell, WMI and the standard remote administration features, is called "living off the land". Which of the following is the most appropriate way of thinking about countermeasures to this technique?
  5. Which of the following correctly matches SIEM, SOAR and SOC with their roles in security monitoring?
  6. In the SolarWinds incident discovered in December 2020, attackers got into the build environment of IT management software and malicious code was mixed into legitimate updates. The updates were distributed carrying the developer's legitimate code signature. Which of the following is the most appropriate lesson from this incident?
  7. For four incidents at an organization, the time from occurrence to detection and the time from detection to containment were 10 hours and 4 hours for incident 1, 30 hours and 2 hours for incident 2, 2 hours and 6 hours for incident 3, and 6 hours and 4 hours for incident 4. Which of the following is the correct combination of the mean time from occurrence to detection (MTTD) and the mean time from detection to containment (MTTC)?

Books on Cyber Attacks and Defense in Practice Ad

As an Amazon Associate I earn from qualifying purchases.

Comparisons that include this term

Related terms

Zero-day attack Argument SIEM (security information and event management) Security operations center Supply chain attack Median Cyber Kill Chain Digital forensics Incident response Indicator of compromise (IoC)

Back to the glossary