EDR: what it is
EDR (Endpoint Detection and Response) is the technology that continuously records what happens on PCs and servers, recognises behaviour typical of an attack and lets you act on the individual machine: isolate it, stop a process, reconstruct what happened.
In short
Traditional antivirus asks "is this file known malware?". EDR asks "is what is happening on this machine normal?". It watches processes, network connections, changes to files and the registry, and logins, and recognises suspicious sequences even when there is no malicious file to find.
How it works
- Telemetry: an agent on the endpoint records events and sends them to a central console.
- Detection: behavioural rules and analytics flag anomalous activity, for example a Word document that launches PowerShell, or a program that starts encrypting hundreds of files a minute.
- Response: from the console you can isolate the machine from the network, terminate a process or quarantine a file.
- Investigation: the event history lets you reconstruct where the attack came in and what it touched.
Many endpoint protection products today combine antivirus and EDR in the same agent. When detection extends to identities, email and cloud, it is called XDR.
Why it matters
Recent attacks often use tools already present in the operating system and valid credentials: nothing for an antivirus signature to recognise. EDR fills this gap. But it produces alerts that need to be assessed quickly, often out of hours: an EDR that nobody watches at night sees the attack and lets it carry on. That is why it is often paired with an MDR service or a SOC.
A practical warning: EDR only protects the machines on which it is installed and active. A PC without the agent, or with protection disabled, is a blind spot. Knowing which endpoints are unprotected is the first check to make.
Example
A salesperson opens the attachment of a fake order confirmation. The document launches a script that downloads a program and tries to delete Windows shadow copies, a typical step before ransomware. None of the files is known to the antivirus, but the sequence (Office, script, deletion of the copies) triggers detection: the laptop is isolated from the network and the attack stops on a single machine.
The next step is just as important: understanding how the attachment arrived, whether others received it and whether any other machine shows the same behaviour. This is where the EDR's event history makes the difference.
Related terms
Where you find it in Dottor Box
Dottor Box monitors the status of antivirus protection on endpoints and flags unprotected PCs and servers. The Cyber Agent adds host intrusion detection, file integrity monitoring and alerts on critical events.
Cyber Agent
The endpoint agent: security events, file integrity and clear, readable alerts.
Learn more SeeSOC and MDR
Dottor Marc's Security Operation Center: monitoring, managed response and, if you need it, 24/7 cover.
Learn more SeeAsset Management
A single IT inventory of devices and software, with a graph map of the network.
Learn more