Endpoint detection and response (EDR)

Endpoint detection and response (EDR) is software installed on laptops, servers, and other endpoints that continuously records process, file, and network activity, applies detection logic to that telemetry, and gives responders the ability to investigate and act, isolating a machine or killing a process, from a central console. It replaced traditional antivirus as the primary endpoint control at most organizations.

EDR differs from antivirus in that it does not rely mainly on matching known-malicious file signatures; it watches behavior over time, which lets it catch techniques cataloged in the MITRE ATT&CK framework even when no indicator-of-compromise for the specific attack exists yet. It differs from extended detection and response in scope: EDR covers endpoints only, while XDR correlates endpoint telemetry with network, identity, and cloud data.

EDR matters because endpoints are where most intrusions ultimately execute code, making endpoint telemetry one of the richest sources feeding a security operations center and a SIEM. A common pitfall is deploying EDR without tuning or without staff to act on its alerts, leaving genuine detections unreviewed in a console nobody watches.