What is Endpoint Detection and Response (EDR)?
Endpoint Detection and Response (EDR) is a category of security software that continuously monitors endpoint activity, records behavioral telemetry, detects threats in real time, and gives security teams the tools to investigate and contain incidents on laptops, servers, and other devices.
What it does
EDR software runs an agent on each endpoint and collects a continuous stream of telemetry: process creation, file writes, registry changes, network connections, and memory activity. It stores that data in a searchable timeline so analysts can reconstruct exactly what happened before, during, and after an incident.
Core capabilities include:
- Real-time detection. Rules and behavioral models flag suspicious activity as it happens, such as a script spawning a shell or a process injecting code into another process.
- Automated response. The agent can isolate a device from the network, kill a process, or quarantine a file without waiting for a human.
- Threat hunting. Analysts can query historical telemetry across all endpoints to look for indicators of compromise that automated rules missed.
- Forensic investigation. The recorded timeline lets responders trace an attack from initial access through lateral movement to data exfiltration.
Some EDR tools operate without a traditional agent. Agentless approaches, common on Linux servers, use read-only access to the operating system to detect threats without installing persistent software.
Why teams buy it
Traditional antivirus stops known malware at the point of entry but leaves little visibility into what happens next. EDR fills that gap. When a threat bypasses prevention, EDR provides the evidence needed to understand scope, evict the attacker, and prevent recurrence. Regulators and cyber insurers increasingly require it.
What to look for
- Telemetry depth. Does it record process trees, memory events, and network connections, or only file activity?