# EDR

> Security software that watches what each computer does and reacts to signs of attack.

- Level: Intermediate
- Topics: Security
- URL: https://tidbit.legios.com.ar/edr/
- In Spanish: [EDR](https://tidbit.legios.com.ar/es/edr/)

**EDR** stands for endpoint detection and response. An endpoint is any device people or programs work on: laptops, desktops, servers. EDR is a small program, an agent, installed on each of them. It records what happens in detail, which processes start, which files change, which network connections open, and sends that stream to a central console where software and analysts look for signs of an attack.

The difference with a classic antivirus is the focus on behavior. Antivirus mainly asks whether a file matches known malware. EDR asks whether a sequence of events makes sense: why did a Word document just launch PowerShell, which then downloaded something and started encrypting hundreds of files? Attackers often use legitimate tools already on the machine, so judging behavior catches things a file scan misses.

The response part matters as much as the detection. From the console, a security team can isolate a laptop from the network with one click, kill a process, delete a file, or go back in the recorded history to see how the intruder got in. Products such as CrowdStrike Falcon, Microsoft Defender for Endpoint and SentinelOne are common in companies, and they feed alerts to the security operations center. Because EDR runs with deep access to the operating system, a bad update can do real damage: in July 2024 a faulty CrowdStrike update crashed millions of Windows computers worldwide. **XDR** (extended detection and response) widens the same idea to email, cloud and network data.

## An analogy

A security camera and a guard in every room of the building, instead of only checking IDs at the front door. When something strange happens in one office, the guard can lock that room right away.

## Keep in mind

- An agent on each device records processes, files and connections.
- Detects suspicious behavior, not only known malicious files.
- Can isolate a machine, kill processes and replay what happened.
- XDR extends the idea beyond endpoints to email, cloud and network.

## Go deeper

- [Endpoint detection and response on Wikipedia](https://en.wikipedia.org/wiki/Endpoint_detection_and_response)
- [What is EDR? (IBM)](https://www.ibm.com/think/topics/edr)

## Related terms

- [Laptop](https://tidbit.legios.com.ar/laptop/): A whole computer folded into one portable case that runs on a battery.
- [Server](https://tidbit.legios.com.ar/server/): A computer whose job is to answer requests from other computers, all day, every day.
- [AI agent](https://tidbit.legios.com.ar/ai-agent/): An LLM that can take actions, check the results and keep going until the job is done.
- [Antivirus](https://tidbit.legios.com.ar/antivirus/): A program that watches your files and apps and blocks the ones known to be harmful.
- [Malware and ransomware](https://tidbit.legios.com.ar/malware-and-ransomware/): Software built to harm you; ransomware locks your files and charges to unlock them.
- [Microsoft](https://tidbit.legios.com.ar/microsoft/): The company of Windows and Office, now just as much a cloud company with Azure.
- [Security operations center](https://tidbit.legios.com.ar/security-operations-center/): The team that watches an organization's systems around the clock for attacks.
- [Operating system](https://tidbit.legios.com.ar/operating-system/): The base software that runs a device and lets every app share its hardware.