Endpoint Detection and Response, or EDR, is a set of technologies designed to monitor, record, and display large sets of data related to activities occurring on endpoint systems. This data is collected in a centralized repository for review and analysis. Endpoint detection and response is primarily a forensic capability that will monitor for attacks as they occur or allow an analyst to triage post exploitation activity to determine how a compromise occurred. If an active compromise is discovered, many EDR solutions include capabilities to quickly respond and potentially recover from this malicious activity.
The goal of any organization is to prevent compromises before they occur. Unfortunately, with Zero-Day exploits and increasingly sophisticated attacks this is not always a possibility. Therefore, when an environment is compromised it’s crucial to have as much historic context as possible in order to reconstruct the full details of the attack. In this way an organization can learn from its past weaknesses to help further enhance its security posture. With a fully deployed endpoint detection and response solution you can actively monitor for and quickly respond to attacks as they occur while reviewing endpoint activity for previously undetected compromises.
The adoption of endpoint detection and response had its beginnings as an on-prem technology with a limited set of events recorded from endpoints. Customers were generally required to purchase a dedicated server or series of servers to act as the controller and repository for recorded data.
EDR technology is now continuing to evolve with modern architectures with many deployments now including the option to no longer require on-prem controllers. Instead a new breed of cloud-based collectors are becoming increasingly utilized. These cloud EDR systems allow organizations to monitor their endpoints while both on and off the corporate network and over geographically dispersed areas. Modern EDR is also greatly increasing the depth of activity and events that are collected. This allows analysts greater insight into all aspects of what has occurred on an endpoint when reconstructing an attack timeline.
There are many important factors to consider when reviewing an endpoint detection and response solution.
