Endpoint Detection and Response (EDR)

Endpoints are the devices that connect to and exchange information with a network: desktop computers, servers, mobile devices, virtual machines, embedded devices, and internet of things devices. EDR tooling monitors these endpoints and detects and responds to malicious and anomalous activity on them. NSA zero trust guidance treats EDR as a fundamental element of an endpoint protection platform, alongside next-generation antivirus and anti-malware.

When the EDR spots suspicious activity on an endpoint, such as an unauthorized attempt to escalate privileges on a workstation, it alerts the security operations center. Analysts use the forensic data the tool collects to investigate. Through the same tool they can quarantine the endpoint remotely and carry out remediation such as removing malware and applying patches. Security policies in the EDR can also isolate a compromised endpoint from the network automatically.

An EDR can run with an agent on each endpoint, without agents, or as a hybrid of the two. Its logs are expected to carry enough data for a SIEM or SOAR to use. The alerts still need people to review them. In one compromise of a US federal agency that CISA responded to, EDR alerts were not continuously reviewed, some public-facing systems lacked endpoint protection, and the activity went undetected for three weeks.