Simple definition
One EDR goes further than a conventional antivirus by observing behaviors and helping investigate an attack.
Technical definition
Endpoint ip and ip collects events, correlates processes, connections and changes, and then allows actions like isolating a machine or stopping a process.
What is it used for ?
Detect ransomware, lateral movements, suspicious scripts and other abnormal behaviors.
Practical example
TheEDR alert when script PowerShell Launches an unknown tool and then tries to contact multiple internal servers.
Common issues
- Agent not installed on certain devices
- Unattended alerts
- too wide
- Insulation triggered without treatment procedure
Related terms
Key takeaway: This entry explains the general operation of the term. Exact settings may vary depending on software, vendors and environments.