EDR

Tooling that monitors endpoints for threats and supports investigation and response.

EDR continuously collects and analyzes endpoint telemetry such as process, file, and registry activity to detect threats that signature based antivirus misses. It supports investigation and response actions like isolating a host, killing a process, or rolling back changes, and it retains data for threat hunting. By focusing on behavior it catches fileless and novel attacks that evade static detection. XDR extends this concept across email, network, and cloud, while MDR adds a managed service layer.