Skip to content

Understanding EDR

Endpoint Detection and Response (EDR) gives security teams detailed visibility into activity on computers and servers so they can detect suspicious behaviour, investigate what happened, and take controlled response actions.

What you will learn

By the end, you should be able to explain how endpoint activity becomes a detection, trace the main EDR workflow, distinguish EDR from antivirus and DFIR, and choose a proportionate response supported by evidence.

What is EDR?

An endpoint is a device such as a laptop, desktop computer, or server. EDR software records selected activity on that device and sends it to a platform where analysts can search, connect, and investigate it.

The activity records are often called telemetry. Useful telemetry may show which program ran, which user started it, what files changed, which settings were modified, and where the device connected. EDR can then apply rules or behaviour checks to highlight activity that needs review.

EDR supports security operations, but it does not prevent every compromise by itself. Its effectiveness depends on healthy agents, useful telemetry, well-tested detections, appropriate data retention, and analysts who can investigate and respond safely.

What EDR is not

Antivirus primarily prevents or removes known harmful files and common malicious behaviour. EDR provides a broader record of endpoint activity and an analyst-led investigation and response workflow. Digital Forensics and Incident Response (DFIR) can use endpoint evidence but also considers identities, networks, cloud services, business impact, evidence handling, recovery, and the wider incident.

EDR does not replace secure configuration, identity protection, network monitoring, backups, recovery planning, or specialist forensic acquisition when deeper evidence is required.

Events, detections, alerts, and incidents

  • An event is a recorded action, such as a process start, file creation, sign-in, or network connection.
  • A detection is activity that matches a rule, known warning sign, or behaviour that the platform is configured to identify.
  • An alert is a signal presented for review, often with related events and a priority. A detection or alert is not proof of compromise.
  • An incident is a confirmed or managed security issue supported by investigation evidence and business context.

Why EDR matters

Improve endpoint visibility

Record useful device activity so analysts can investigate events that would otherwise be short-lived or difficult to reconstruct.

Link programs, files, users, settings, and connections to reveal a sequence that may not be suspicious when each event is viewed alone.

Detect suspicious behaviour

Apply tested rules and behaviour checks to identify activity that warrants analyst review.

Respond with context

Help analysts preserve evidence, contain confirmed risk, verify the result, and record what changed.

How EDR works

  1. CollectRecord selected activity from the endpoint and confirm the agent is healthy.Maintain visibility
  2. ConnectLink related programs, files, users, settings, and network activity.Build the activity story
  3. DetectApply rules and behaviour checks to identify activity that needs review.Create a signal
  4. PrioritiseAdd device, user, prevalence, and business context so analysts know what to examine first.Focus attention
  5. InvestigateTest possible explanations and check the endpoint against identity, network, and wider incident evidence.Validate the concern
  6. RespondUse approved actions that match the evidence, confidence, urgency, and operational impact.Limit further harm
  7. Verify and improveConfirm the action worked, record the outcome, and tune detections and response guidance.Learn from results

EDR products use different detection methods. These may include shared rules, known warning signs, behaviour patterns, statistical models, or machine learning. No method guarantees detection or prevention, and every result still needs suitable validation.

What EDR records

EDR may record program starts and parent-child relationships, file changes, sign-ins and permission use, services and startup settings, network connections, detections, and response results. Analysts connect these records by device, user, process, file, destination, and time to reconstruct activity.

The exact telemetry depends on the product, operating system, configuration, permissions, and agent health. Missing or delayed records can change an investigation conclusion, so collection coverage and timestamps must be checked before relying on the evidence.

Investigate endpoint activity

One event may look harmless. A connected sequence can tell a different story. In this guided lab, you are the first analyst reviewing an alert from a finance laptop.

Try it: investigate a suspicious endpoint

Open each evidence record, decide what the sequence supports, and choose the safest first response. Everything is synthetic and no software is required.

Training alertCase EDR-1042
Stage 1 of 4Case quality 0/3
HighNew alert
Suspicious child process from an Office document

Invoice document launched hidden PowerShell

A rule detected an unusual program relationship on a finance laptop. Your task is to determine what the available evidence supports—not to guess beyond it.

Device
FIN-LT-22
User
j.lee
First seen
10:14
Agent
Healthy
  1. 1Review alert
  2. 2Inspect evidence
  3. 3Assess
  4. 4Respond

1 Inspect and select evidence

Open all six records, then select only those that help explain the alert. Two records are normal background activity.

Locked

Acknowledge the alert to begin reviewing records.

2 Choose the most defensible assessment

Select the conclusion supported by the records. Severity alone is not proof.

3 Build the response plan

The endpoint is online and the connection may be active. Put containment, evidence, wider scope, and verification into the plan.

Review the alert, then inspect each evidence record.

What makes EDR useful

A useful deployment starts with a question such as “Can we detect a document starting an unexpected command tool?” The team then chooses the required telemetry, checks that events and timestamps are reliable, tests the detection with controlled activity, and documents how analysts should validate and respond.

Common problems include missing agents, delayed events, noisy rules, insufficient retention, unclear response ownership, and untested actions. Measure coverage, agent health, telemetry delay, detection quality, investigation time, and response success rather than alert volume alone.

Match the response to the risk

Isolation, process termination, and quarantine can disrupt operations or destroy useful evidence. Follow approved procedures, consider identity and wider incident scope, and test automated actions with narrow conditions, approval boundaries, verification, and rollback. Remember that offline devices, unhealthy agents, retention limits, and false detections create visibility gaps.

Endpoint and forensic tools in this kit

The tools in this section support different parts of the endpoint investigation workflow. They are not equivalent enterprise EDR products.

Solution Choose it first when Primary evidence Notable strengths Considerations
Aurora Lite You want focused Windows endpoint monitoring using defined rules and known warning signs Windows activity collected through Event Tracing for Windows Lightweight endpoint telemetry, Sigma-based detections, indicators of compromise, and configured response actions It has a narrower feature set than a full enterprise EDR platform. Confirm supported Windows versions, permissions, licensing, updates, exclusions, logs, and performance before use
Velociraptor You need targeted artefact collection, repeatable endpoint queries, or hunts across several systems Host artefacts collected in response to investigation questions Flexible collection, remote queries, repeatable hunts, and forensic investigation workflows Treat it as an endpoint visibility and forensic collection platform rather than a direct substitute for every EDR capability. Plan access, evidence storage, query impact, retention, and audit records
Open Aurora Lite guide Open Velociraptor guide

Start with Aurora Lite to practise Windows endpoint telemetry and detection. Use Velociraptor when the question requires targeted artefacts, repeatable hunts, or deeper endpoint investigation. Add either tool only after defining the evidence and decision the lab must support.

Continue learning