Skip to content

Glossary: Endpoint and Application Security

EDR (endpoint detection and response)

Also written: endpoint detection and response

Agents that record each endpoint's processes, files, connections and logins, detect suspicious behavior, and respond by killing, quarantining or isolating. EDR caught the PowerShell chain from Priya's attachment.

Where the book teaches it

Related terms

XDR (extended detection and response)Behavior-based detectionIsolate the hostAntivirus (AV)