What is EDR?
Endpoint Detection and Response, told as a story about a guard dog in every room.
Watching the wall tells you nothing about the rooms.Each room is one computer. What if the burglar is already inside?
EDR is a guard dog in every room.It watches everything that happens in the room, and writes it down.
It watches what you do, not what you look like.The old gatekeeper (antivirus) only checked faces. The dog watches habits.
It barks, and locks the door.So the burglar can't reach other rooms. Then it tells the guard room.
A room with no dog is dark.Each dog sees only its own room. Stories across rooms are joined on the big screen.
EDR = a guard dog in every room (computer). It watches behavior, barks, and locks the door.
Endpoint Detection and Response. It watches inside the room (the computer), not the wall (the network). Antivirus checked faces; EDR watches behavior.
When grown-ups say it
- Endpoint
- One room. A laptop, a server, a phone — any one computer where work happens.
- Agent
- The dog. A small program installed in each room. Without it, that room is dark.
- Antivirus
- The photo gatekeeper. Matches known bad files against photos (signatures). A disguise gets past it.
- Behavioral detection
- Watching behavior. Whoever opens the vault gets barked at. → the habit story
- Isolation
- Locking the room. Cutting that computer off from the others for a while.
- Response
- The bite. Stopping the bad program and deleting files, from afar.
- Telemetry
- The dog's diary. Everything the dog saw, written down and sent to the big screen.