← Back to glossary
🖥️

Endpoint Detection and Response (EDR)

Security

Incident Response (IR) Malware Endpoint Security Monitoring

Endpoint telemetry + detection + response tooling for threat hunting, containment, and remediation.

Definition

EDR collects endpoint telemetry (processes, network connections, file changes), detects suspicious activity, and supports response actions like isolation and rollback.

In plain English Endpoint telemetry + detection + response tooling for threat hunting, containment, and remediation.

Why this matters

Why it matters: Faster containment reduces data loss and lateral movement.

Example

Example: Detect credential dumping, isolate the host, collect forensic evidence, and remediate with patches and account resets.