{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/edr","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/edr/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/edr/"},"term":{"en":"Endpoint detection and response (EDR)","da":"Endpoint detection and response (EDR)"},"aka":{"en":["EDR"],"da":["EDR"]},"domain":["security"],"cluster":"controls","layer":"host","status":"current","era":2013,"summary":{"en":"Software on each computer and phone that watches for signs of an attack and can stop it on the spot.","da":"Software på hver computer og telefon, der holder øje med tegn på angreb og kan stoppe dem på stedet."},"body":{"formal":{"en":"A tool installed on every endpoint that records what programs and users do, flags behaviour that matches known attack patterns, and lets defenders cut the device off, end a process or undo changes from one central screen.","da":"Et værktøj, der installeres på hvert endpoint, registrerer hvad programmer og brugere gør, markerer adfærd, der ligner kendte angrebsmønstre, og lader forsvarerne isolere enheden, stoppe en proces eller rulle ændringer tilbage fra én central skærm."},"plain":{"en":"Like a guard posted inside every room of a building rather than only at the front door - they notice odd behaviour and can lock the room at once.","da":"Som en vagt i hvert eneste rum i bygningen i stedet for kun ved hoveddøren - vagten opdager mærkelig adfærd og kan låse rummet med det samme."},"inPractice":{"en":"A laptop in a pension fund's customer department suddenly starts locking hundreds of files; the EDR tool spots the pattern, stops the process and cuts the laptop off the network before the IT operations manager has even seen the alarm.","da":"En bærbar i en pensionskasses kundeafdeling begynder pludselig at låse hundredvis af filer; EDR-værktøjet genkender mønstret, stopper processen og isolerer maskinen fra netværket, før den IT-driftsansvarlige overhovedet har set alarmen."},"whyItMatters":{"en":"Attackers who slip past the outer defences still have to act on some device, so watching every device closely is often the last real chance to catch them early.","da":"Angribere, der slipper forbi de ydre forsvar, skal stadig handle på en enhed, så tæt overvågning af hver enhed er ofte den sidste reelle chance for at fange dem tidligt."}},"deepDive":{"en":"The category was named in 2013 by Gartner analyst Anton Chuvakin as \"endpoint threat detection and response\", later shortened to EDR. Its defining shift from classic antivirus (now usually called EPP, endpoint protection platform) is continuous telemetry recording rather than file scanning alone. On Windows an EDR sensor typically combines a kernel-mode driver registering process, thread, image-load and registry callbacks (PsSetCreateProcessNotifyRoutineEx and related APIs), a file-system minifilter, network filtering, Event Tracing for Windows providers including the Microsoft-Windows-Threat-Intelligence provider, and the Antimalware Scan Interface (AMSI) for script content. On macOS and Linux the equivalents are Apple's Endpoint Security framework and eBPF or audit subsystems respectively.\n\nTelemetry - process trees with command lines, parent/child relationships, network connections, file and registry writes, module loads - is streamed to a cloud or on-premises backend. Detection combines local machine-learning classifiers, behavioural rules (for example Office spawning a PowerShell process that downloads and executes content), indicators of compromise and analytics mapped to MITRE ATT&CK techniques. Response actions include network containment (the host can reach only the EDR backend), process kill, file quarantine, remote shell for live forensics and, on some platforms, rollback of changes. Retained telemetry enables threat hunting and retrospective queries when a new indicator is published.\n\nEDR has well-known limits. Attackers disable or blind sensors through \"bring your own vulnerable driver\" (BYOVD) techniques that load a legitimately signed but vulnerable kernel driver to kill protected processes, through unhooking of user-mode hooks, or by operating from assets without a sensor - hypervisors, network appliances, OT and IoT devices, unmanaged machines. Tamper protection and alerting on sensor silence are therefore essential. Kernel presence is also an availability risk: on 19 July 2024 a faulty content update to CrowdStrike Falcon crashed roughly 8.5 million Windows machines, prompting Microsoft to work with vendors on moving security functionality out of the kernel.\n\nNeighbouring terms: XDR extends the same detection-and-response model across email, identity, cloud and network sources; MDR is a managed service in which an external SOC operates the EDR; a SIEM ingests EDR alerts for correlation with other logs but is not a replacement for the sensor. EDR supports CIS Controls v8 Control 10 (Malware Defenses) and ISO/IEC 27002:2022 controls 8.7 (protection against malware) and 8.16 (monitoring activities). An EDR deployment is only as good as its coverage and triage: the metric that matters is the share of endpoints with a healthy sensor and the time from alert to containment.","da":"Kategorien blev navngivet i 2013 af Gartner-analytikeren Anton Chuvakin som \"endpoint threat detection and response\", senere forkortet til EDR. Det, der adskiller den fra klassisk antivirus (i dag ofte kaldt EPP, endpoint protection platform), er kontinuerlig optagelse af telemetri frem for alene at scanne filer. På Windows kombinerer en EDR-sensor typisk en kernel-driver, der registrerer callbacks for processer, tråde, indlæsning af moduler og registreringsdatabasen (PsSetCreateProcessNotifyRoutineEx og beslægtede API'er), en minifilter i filsystemet, netværksfiltrering, Event Tracing for Windows-udbydere, herunder Microsoft-Windows-Threat-Intelligence, og Antimalware Scan Interface (AMSI) til scriptindhold. På macOS og Linux er de tilsvarende mekanismer Apples Endpoint Security-framework og henholdsvis eBPF eller audit-undersystemer.\n\nTelemetrien - procestræer med kommandolinjer, forældre-/barnrelationer, netværksforbindelser, skrivninger til filer og registreringsdatabase, indlæste moduler - streames til en backend i cloud eller on-premises. Detektionen kombinerer lokale machine learning-klassifikatorer, adfærdsregler (fx at Office starter en PowerShell-proces, der henter og kører indhold), kompromitteringsindikatorer og analyser kortlagt til MITRE ATT&CK-teknikker. Responshandlinger omfatter netværksisolering (maskinen kan kun tale med EDR-backenden), afslutning af processer, karantæne af filer, fjern-shell til live-forensics og på nogle platforme tilbagerulning af ændringer. Gemt telemetri muliggør threat hunting og tilbagevirkende søgninger, når en ny indikator offentliggøres.\n\nEDR har velkendte begrænsninger. Angribere deaktiverer eller blænder sensorer med \"bring your own vulnerable driver\" (BYOVD), hvor en legitimt signeret, men sårbar kernel-driver indlæses for at dræbe beskyttede processer, ved at fjerne hooks i user mode eller ved at operere fra aktiver uden sensor - hypervisorer, netværksudstyr, OT- og IoT-enheder og uadministrerede maskiner. Manipulationsbeskyttelse (tamper protection) og alarmer, når en sensor går tavs, er derfor afgørende. Tilstedeværelsen i kernen er også en tilgængelighedsrisiko: den 19. juli 2024 fik en fejlbehæftet indholdsopdatering til CrowdStrike Falcon omkring 8,5 millioner Windows-maskiner til at gå ned, hvilket fik Microsoft til at arbejde med leverandørerne om at flytte sikkerhedsfunktionalitet ud af kernen.\n\nNabobegreber: XDR udvider samme detektions- og responsmodel til mail, identitet, cloud og netværk; MDR er en managed service, hvor en ekstern SOC driver EDR'en; en SIEM modtager EDR-alarmer til korrelation med andre logs, men erstatter ikke sensoren. EDR understøtter CIS Controls v8 Control 10 (Malware Defenses) og ISO/IEC 27002:2022 kontrol 8.7 (beskyttelse mod malware) og 8.16 (overvågningsaktiviteter). En EDR-udrulning er aldrig bedre end dens dækning og triage: de tal, der tæller, er andelen af endpoints med en sund sensor og tiden fra alarm til isolering."},"edges":[{"type":"requires","to":"security/endpoint","confidence":"high","strength":"normal"},{"type":"kind-of","to":"security/control","confidence":"high","strength":"normal"},{"type":"mitigates","to":"security/malware","why":{"en":"It recognises harmful programs by what they do, not only by what they look like, and stops them.","da":"Det genkender skadelige programmer på, hvad de gør, ikke kun på hvordan de ser ud, og stopper dem."},"confidence":"high","strength":"primary"},{"type":"mitigates","to":"security/ransomware","why":{"en":"Mass locking of files is a clear pattern it can spot and halt within seconds.","da":"Når mange filer låses på én gang, er det et tydeligt mønster, som det kan opdage og standse på sekunder."},"confidence":"high","strength":"normal"},{"type":"used-with","to":"security/siem","why":{"en":"Its alarms are sent to the SIEM so they can be seen next to events from the rest of the organisation.","da":"Dets alarmer sendes til SIEM'en, så de kan ses sammen med hændelser fra resten af organisationen."},"confidence":"high","strength":"normal"},{"type":"used-with","to":"security/soc","confidence":"high","strength":"normal"}],"depth":2,"sources":[{"title":"CIS Controls v8 - Control 10 (Malware Defenses) and Control 13 (Network Monitoring and Defense)","tier":"standard","publisher":"Center for Internet Security"},{"title":"NIST SP 800-83 Rev. 1 - Guide to Malware Incident Prevention and Handling","tier":"standard","publisher":"NIST"}],"draft":true}