thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Foundational

Endpoint Detection and Response (EDR)

Security software that continuously records endpoint activity, detects malicious behavior and enables investigation and response.

Definition

EDR agents collect process, file, registry, network and user activity telemetry, apply behavioral analytics and threat intelligence, and allow responders to isolate hosts, kill processes, quarantine files and run remote investigations. Examples include CrowdStrike Falcon Insight, Microsoft Defender for Endpoint, SentinelOne and Cortex XDR.

Example

Isolating a laptop from the network via the EDR console while keeping the agent connection for investigation.

Exam tip

EDR adds detection, investigation and response to traditional antivirus prevention.

Don't confuse it with

Related terms