Endpoint Detection and Response (EDR)
- •
def
- •
a threat protection approach for endpoints that goes beyond signature-based detection, using behavioral analysis, machine learning, and process monitoring via a lightweight agent
- •
- •
lifecycle
- •
detect a threat, investigate it (root cause analysis), and respond — isolate the system, quarantine the threat, or roll back to a previous configuration
- •
- •
note
- •
typically API-driven, requiring no user or technician intervention to respond
- •
- •
- •