What Is EDR?

EDR, short for endpoint detection and response, is security software that watches computers for signs of an attack. It gives security teams a way to investigate suspicious activity, follow an intruder's movements and take action against them.

Those computers are the endpoints in its name: the laptops, desktops and servers where people work, store files and access company systems. When one of them is compromised, the consequences can reach well beyond a single machine.

But an attack leaves clues. By collecting and connecting them, EDR helps defenders piece together what's happening while there's still a chance to limit the damage.

EDR at a Glance

• EDR uses software on an endpoint, usually called an agent or sensor, to collect information about activity on that device.
• It looks for suspicious behavior in running programs, file changes, network connections and other events.
• Security teams can use the collected information to investigate an alert and trace the events leading up to it.
• Response tools can stop malicious processes, quarantine files or isolate a compromised computer from the network.
• Some responses can happen automatically, depending on the product, its settings and the threat it detects.
• EDR still needs people to manage it, investigate uncertain findings and oversee recovery after an attack.

How EDR Works

Imagine that ransomware has started running on an employee's laptop. In the background, it's opening and encrypting files, leaving the employee unable to use them.

An EDR agent may recognize this pattern and raise an alert. If the product supports it and the appropriate response is enabled, it can also stop the offending program or isolate the laptop to help contain the attack.

For the security team, though, stopping that program is only the beginning. They still need to find out how it arrived, what it changed and whether other computers were affected.

That investigation depends on the work EDR was doing before anyone realized there was a problem.

The Agent on the Endpoint

An EDR agent runs on the computer it's protecting, collecting information that can help reveal an attack. The exact details depend on the product and operating system, but they commonly include running programs, file changes, user logins and network connections.

A running program is called a process. By tracking processes, EDR can show which program started another, what commands it used and which account it ran under. This gives investigators a way to follow activity from one program to the next.

On Windows, an agent may also watch the registry, a database of system and application settings. Malware can change those settings to make itself run again after a restart, giving an intruder a way to return.

An agent can also collect information about memory and network activity. But it doesn't see everything: Microsoft notes that its EDR doesn't record every operation on a computer. Investigators still have to work within the limits of what was collected and how long those records were kept.

Following the Attack

Much of the activity an EDR tool watches is ordinary computer use. Programs create files, administrators run scripts, and employees sign in throughout the day.

The challenge is recognizing when familiar tools are being used for something malicious. PowerShell, for instance, is a legitimate tool for administering computers, but attackers can use it to run their own commands as well.

This is where behavior monitoring becomes useful. A suspicious command, an unexpected connection and a burst of file changes may tell a more revealing story together than any one event would on its own.

Once an alert appears, an analyst can examine the sequence of events and search other monitored computers for related activity. Finding the same malicious file or connection elsewhere may reveal that the incident reaches further than the original laptop.

This investigative work is a major part of EDR's value. Modern antivirus software can also detect suspicious behavior; Microsoft Defender Antivirus includes behavior monitoring, for example. EDR adds tools for following the wider incident and coordinating the response.

Cutting Off the Intruder

Once defenders identify a threat, they need a way to act on what they've found.

Depending on the product, they can stop a malicious process, quarantine a file or isolate the affected computer. Isolation restricts its network connections, helping prevent an intruder from reaching other machines or continuing to communicate with an outside server.

Some products preserve a connection to their own management service so investigators can keep working on the isolated device. Microsoft Defender for Endpoint keeps this connection open during isolation, allowing it to continue monitoring the computer.

Automation can make these responses faster, but the available actions depend on the device, subscription and configuration. An alert doesn't always mean that the threat has already been contained.

Recovery has its own limits. Some products offer ransomware rollback, which can restore affected files from snapshots, or saved copies. SentinelOne uses Windows shadow copies to bring back earlier versions of files affected by an attack.

But rollback isn't available in every EDR product or on every operating system, and its usefulness depends on having recoverable copies. It can't undo the theft of data an attacker has already copied. Separate, tested backups still matter; CISA includes them in its ransomware recovery guidance.

When Would You Use It?

EDR becomes useful when an organization needs to investigate and respond to threats across multiple computers. An alert on one laptop may be straightforward to examine. Working out whether the same attack reached a department's desktops and servers takes a broader view.

The collected records also support threat hunting: deliberately searching for signs of an intruder before an alert tells you where to look. After an incident, they can help explain how the attack unfolded and which weaknesses need attention.

But someone still has to do that work. Agents need to stay installed and healthy, alerts need investigation, and legitimate activity can sometimes look suspicious enough to trigger a false alarm.

Organizations without enough security staff can use managed detection and response, or MDR. This brings in a team to monitor security tools, investigate findings and respond within an agreed scope. For example, Huntress Managed EDR includes a security operations center staffed around the clock.

A managed service provider, or MSP, may arrange or deliver that coverage. The service agreement matters: providing general IT support doesn't automatically mean that someone is investigating security alerts at three in the morning.

Popular EDR Options

Several established security companies offer EDR, sometimes as part of a larger product. The differences become clearer when you look at who will investigate alerts, which devices are supported and what the subscription actually includes.

These are five examples of the available approaches:

XDR, or extended detection and response, expands the investigation beyond endpoints to sources such as identity and cloud services. It can include EDR, so seeing both terms on a vendor's website doesn't necessarily mean you're looking at unrelated products.

How Much Does an EDR Solution Cost?

The cost depends on what you're buying and how the vendor counts it. A subscription may charge per endpoint or per user, and a software license can cover a different set of services from a managed security package.

Huntress, for example, describes its Managed EDR subscription as a per-endpoint service that includes both the agent and 24/7 monitoring and response. Comparing that price with a software-only license means accounting for the people needed to run the latter.

For a simple budgeting example, a quote of $10 per endpoint per month would put 100 endpoints at $1,000 a month. That's an illustration, not a market average or a current vendor offer.

Before comparing quotes, check whether they include your servers, how long investigation data is retained and whether someone is available to respond outside office hours. Deployment, ongoing administration and any separately charged recovery work belong in the budget as well.

A low license price is less useful if your team can't keep up with the alerts it produces. The practical question is how much it costs to keep the software running and have someone ready to act on its findings.

EDR: Piecing Together the Attack

When ransomware appears on a laptop, the damaged files are only part of the story. Defenders need to understand how the attacker got in, what else they reached and what will stop them from returning.

EDR gives them records and response tools to help answer those questions. And while it can't guarantee a clean recovery, it can make an intruder's movements much harder to hide.

Related Posts:

• Antivirus Software: Is It Enough for Cyber Protection?
• VirusTotal: The Cybersecurity Practitioner's Multi-Engine Shield
• The Ransomware Menace: Understanding and Mitigating Risks
• Behavior Monitoring: Can It Predict Cyber Attacks?