What Is EDR? Endpoint Detection and Response Explained

An agent installs on the endpoint with enough privilege to observe the operating system's own activity — on Windows through kernel-level and event-tracing interfaces, on macOS and Linux through the platform's endpoint security frameworks. It streams a filtered version of that activity to a cloud or on-premises analysis platform, keeps a local buffer so it can keep working while offline, and enforces whatever preventive policy the product also carries. The design goal is a continuous record rather than a periodic scan, which is what allows an investigator to reconstruct a sequence hours after it happened.

Detection runs in two places. Locally, the agent applies behavioral rules so obvious malicious activity can be blocked in the moment, without a round trip. Centrally, the platform correlates across time and across machines, applies threat intelligence, and runs analytics that only make sense with a wider view — a credential-dumping pattern on one host followed by an unusual authentication from it to three others, for example. Most products map their detection logic to MITRE ATT&CK technique identifiers, which is genuinely useful: it gives detections a shared vocabulary and makes coverage gaps discussable rather than a matter of vendor assertion.

Retention is the quiet variable in every quote. How long the raw telemetry is kept, at what granularity, and whether longer retention costs more will decide whether an investigation started three weeks after an intrusion has anything to work with. Ask for the default retention period, the maximum, and the price of the difference, because dwell times routinely exceed the default a platform ships with.

Traditional antivirus asks a single question about a file: does it match something known to be bad. That works against commodity malware and fails against anything novel, anything packed or obfuscated to change its signature, and against attacks that use no malicious file at all — a legitimate administrative tool driven to a malicious end, a script run in memory, credentials stolen and used to log in normally. EDR asks a different question, about behavior over time, and that is where those techniques become visible.

In practice the distinction is no longer a product boundary. Current endpoint platforms bundle preventive protection — signatures, reputation, machine-learning file classification, exploit mitigation — with the detection and response layer, and are sold as the replacement for standalone antivirus rather than as an addition to it. The industry shorthand separates endpoint protection, the preventive half, from endpoint detection and response, the observational and remedial half, but you will normally be buying one agent that does both.

One operational rule follows from that: do not run a legacy antivirus product alongside an EDR agent. The two compete for the same operating-system hooks, the conflicts are difficult to diagnose, and the vendors themselves advise against it. Decommissioning the incumbent is part of the rollout plan, not a follow-up task, and the order in which agents are installed and removed on each machine is worth writing down before the first wave.

The standard actions are network isolation, process termination, file quarantine or deletion, and — where the platform supports it — rollback of changes made by an attack, most usefully for ransomware encryption. Network isolation is the one that matters most under pressure: the host is cut off from everything except the management channel, so the machine stops spreading anything while remaining available to an investigator. Doing that to a hundred machines from a console in ninety seconds is the capability that changes how an incident goes.

Most platforms also offer live response — an interactive session on the endpoint for collecting artifacts, running scripts and pulling files for analysis. It is powerful and it is a privilege worth governing deliberately, because a remote shell on every endpoint in the organization is exactly as sensitive as it sounds. Role separation, approval requirements for destructive actions, and an audit trail of who did what on which host should be configured on the first day rather than after the first argument.

Automation is where the value scales and where the risk lives. Rules that isolate a host automatically on a high-confidence detection cut response time to nothing, and the same rule firing on a false positive takes a production server off the network at an inconvenient hour. The pattern that works is automatic containment for a small, high-confidence set, human approval for everything else, and a documented, tested path for reversing an isolation quickly.

A new deployment produces a lot of noise, and most of it is not wrong so much as uninteresting: administrative scripts that look like reconnaissance, backup software touching thousands of files, developer tooling doing things that in another context would be alarming, and a long tail of line-of-business applications behaving strangely because they were written in 2009. Working through that is the first month's job, and it is what turns an alert stream into something a person can act on.

Tuning has a failure mode in each direction. Suppress too aggressively and the platform stops reporting the technique an attacker will eventually use; suppress too little and the queue is abandoned, which is functionally the same as having no detection at all. The defensible approach is to record every exclusion with a reason, a scope as narrow as it can be — this binary, on these hosts, doing this specific thing — and a review date, so the exclusion list stays a maintained artifact instead of accumulating quietly for three years.

Then there is the staffing question, which is the honest bottom of this page. Detections arrive at all hours, and their value decays fast. An organization that cannot cover nights and weekends is buying a platform whose main output arrives when nobody is reading, and the usual answers are a managed detection and response service, a shared rota with a partner, or a deliberate decision to accept the gap in writing. All three are better than assuming the queue will get worked.

For federal civilian agencies the requirement is explicit. OMB Memorandum M-22-01, issued under Executive Order 14028, directed agencies to deploy endpoint detection and response capability and to provide CISA with the visibility to support government-wide detection and hunting. That memorandum is the reason endpoint detection and response appears as a named capability in so many federal programs rather than as one option among several for meeting a generic monitoring control.

In the contractor and grantee world the requirement is expressed as an outcome. The System and Information Integrity family in NIST Special Publication 800-171 requires monitoring of systems for attacks and indicators of potential attacks and protection against malicious code — controls an EDR platform is a natural way to satisfy, and which an assessment under CMMC will expect evidence for. Nothing in either document names a product; what an assessor looks for is coverage across the systems that handle the protected information, and records showing that what the tooling produced was actually reviewed.

CISA's Zero Trust Maturity Model treats detection and response on the device itself as a Devices-pillar capability, alongside device inventory and compliance enforcement, which is the cleanest way to explain the relationship to the rest of a program: mobile device management establishes and verifies the device's baseline, EDR watches what happens on top of that baseline, and access decisions consume both. Cyber-insurance questionnaires have converged on much the same list, and a renewal is now a common trigger for the purchase.

The agent consumes CPU, memory and disk on every machine it runs on. On current hardware that is unremarkable; on a fleet at the end of its refresh cycle, or on servers already sized to their limits, it is the difference between a quiet deployment and a month of performance complaints. Run the pilot on the oldest hardware in the estate rather than the newest, and treat a fleet that cannot absorb the agent as a refresh conversation rather than an argument with the vendor about overhead.

Coverage gaps are the other planning item. Every estate contains systems the agent cannot be installed on: appliances, embedded and operational-technology equipment, unsupported legacy operating systems, and the occasional application vendor who withdraws support if anything else is installed. Those systems do not become secure by omission, and the answer is usually network-level segmentation and monitoring around them plus an explicit record of the exception. Inventory them before the license count is finalized, because that count and the coverage claim need to describe the same thing.

Finally, the commercial shape. EDR is licensed per endpoint, per year, in tiers that gate features such as extended retention, threat hunting and managed services. Server licenses usually cost more than workstation ones. The evaluation figures worth pinning down are retention length, what the tier above includes, whether the console is multi-tenant if that matters, and — if data residency is a requirement — where the telemetry is actually stored, since the analysis platform is a cloud service in most designs.