Endpoint detection and response (EDR)

The category was named in 2013 by Gartner analyst Anton Chuvakin as "endpoint threat detection and response", later shortened to EDR. Its defining shift from classic antivirus (now usually called EPP, endpoint protection platform) is continuous telemetry recording rather than file scanning alone. On Windows an EDR sensor typically combines a kernel-mode driver registering process, thread, image-load and registry callbacks (PsSetCreateProcessNotifyRoutineEx and related APIs), a file-system minifilter, network filtering, Event Tracing for Windows providers including the Microsoft-Windows-Threat-Intelligence provider, and the Antimalware Scan Interface (AMSI) for script content. On macOS and Linux the equivalents are Apple's Endpoint Security framework and eBPF or audit subsystems respectively.

Telemetry - process trees with command lines, parent/child relationships, network connections, file and registry writes, module loads - is streamed to a cloud or on-premises backend. Detection combines local machine-learning classifiers, behavioural rules (for example Office spawning a PowerShell process that downloads and executes content), indicators of compromise and analytics mapped to MITRE ATT&CK techniques. Response actions include network containment (the host can reach only the EDR backend), process kill, file quarantine, remote shell for live forensics and, on some platforms, rollback of changes. Retained telemetry enables threat hunting and retrospective queries when a new indicator is published.

EDR has well-known limits. Attackers disable or blind sensors through "bring your own vulnerable driver" (BYOVD) techniques that load a legitimately signed but vulnerable kernel driver to kill protected processes, through unhooking of user-mode hooks, or by operating from assets without a sensor - hypervisors, network appliances, OT and IoT devices, unmanaged machines. Tamper protection and alerting on sensor silence are therefore essential. Kernel presence is also an availability risk: on 19 July 2024 a faulty content update to CrowdStrike Falcon crashed roughly 8.5 million Windows machines, prompting Microsoft to work with vendors on moving security functionality out of the kernel.

Neighbouring terms: XDR extends the same detection-and-response model across email, identity, cloud and network sources; MDR is a managed service in which an external SOC operates the EDR; a SIEM ingests EDR alerts for correlation with other logs but is not a replacement for the sensor. EDR supports CIS Controls v8 Control 10 (Malware Defenses) and ISO/IEC 27002:2022 controls 8.7 (protection against malware) and 8.16 (monitoring activities). An EDR deployment is only as good as its coverage and triage: the metric that matters is the share of endpoints with a healthy sensor and the time from alert to containment.