The antivirus mainly seeks to block known or suspicious malicious files and behaviors. The EDR adds continuous telemetry, investigative and response capabilities on the posts.
In brief….A modern BDU typically includes anti-virus functions. additional interest comes mainly from visibility and response capacity, which must actually be exploited.
Solution A.
Antivirus
The antivirus protects the station by analyzing files, processes and downloads.
Key points…
- Signature, reputation and heuristic detection
- Quarantine or automatic removal
- Administration more or less centralized according to product
Solution B.
EDR
The EDR collects terminal events to detect attack chains and allow an investigation.
Key points…
- Process history and connections
- Search for indicators and remote response
- Can isolate a position or stop a process
Comparative table….
| Criterion…. | Antivirus | EDR |
|---|---|---|
| Objective | Prevention and blocking | Detection, investigation and response |
| Visibility | Local event | Detailed and centralized chronology |
| Operation | Often automatic | Need for supervision and skills |
| Public | All posts | Organizations in need of advanced detection |
Choose Antivirus if…
You are looking for basic protection on unsupervised positions and have limited means.
Choose EDR if…
You need to investigate incidents, centralize alerts and respond quickly to multiple positions.
Key takeaways
A modern BDU typically includes anti-virus functions. additional interest comes mainly from visibility and response capacity, which must actually be exploited.
Deepening the two notions….
← Back to all comparison…