EDR
Endpoint Detection and Response: software on endpoints that continuously records activity, detects malicious behavior, and lets responders investigate and act, such as isolating a host, giving deep visibility and control over what happens on each device.
Concept Neighborhood
Explore this concept’s connections in the groups below.
Start here
Sysmon
A related concept to explore, covered by 8 lessons.
Endpoint Isolation
A containment action that cuts a compromised host off from the network while keeping it accessible to responders, stopping the attacker from spreading or communicating out while preserving the system for investigation.
3
lessons
Endpoint Alerts
SOC alerts originating from endpoint security tools like EDR and antivirus, flagging suspicious processes, malware, persistence, or anomalous host behavior. Endpoints are where much attacker activity executes, making these alerts high-value.
1
lesson
Related Lessons
1 lesson covers this conceptSign in to open lesson content directly.