Malware and cyber defence, explained
What is EDR (endpoint detection and response)?
EDR (endpoint detection and response) is security software that continuously records what happens on every computer and server in an organisation, such as which programs start, what they connect to and which files they change, and alerts defenders to suspicious activity so they can investigate and stop it, often from one console. Antivirus tries to block bad files; EDR assumes something will get through and helps people find and contain it.
What EDR records
An EDR agent on each device records the events an investigator needs to reconstruct an attack.
- Processes: every program that starts, the program that started it, and its full command line.
- Network: which process connected to which address and port.
- Files: files created, changed, renamed or deleted, and their hashes.
- Persistence: changes to startup items, scheduled tasks, services and registry keys that make programs run automatically.
- Logins: who signed in where, and how.
The events are sent to a central console, so a defender can search across thousands of devices at once: which other machines ran this file, or talked to this address, in the last 30 days?
What an EDR alert looks like
An EDR alert is usually a process tree with one branch that should not be there. Here is a typical one: a malicious document opened from an email.
No single file here has to be known malware. What gives the attack away is the relationship: a word processor has no business starting PowerShell with encoded commands. EDR rules are written around such relationships, and most products label them with techniques from the MITRE ATT&CK framework, the shared catalogue of how attackers operate.
How defenders respond with EDR
The R in EDR is the response tools, which work remotely on any device with the agent.
- Isolate the device from the network, while keeping its connection to the EDR console so the investigation can continue.
- Kill the process and quarantine the file.
- Collect evidence: memory, logs and files, before anything is wiped.
- Hunt: search every other device for the same hash, address or behaviour.
These are the tools of the containment stage in incident response.
EDR vs antivirus
| Antivirus | EDR | |
|---|---|---|
| Main question | Is this file malicious? | What is happening on this device, and is it an attack? |
| Works by | Blocking files and behaviour automatically | Recording activity, alerting, and helping people investigate |
| Sees | One file or process at a time | The full chain of events, across every device |
| Needs a person | Rarely | Yes, to triage alerts and respond |
| Built for | Everyone | Organisations with a security team or provider |
How antivirus detects malware explains what the first column does well. When an EDR alert turns up a file nobody recognises, the next step is malware analysis.
Questions people ask
Is EDR the same as antivirus?
No. Antivirus decides whether a file is malicious and blocks it. EDR records activity on the device so people can see an attack that no single file gives away, and gives them tools to respond, such as isolating the device. Most EDR products include antivirus as well.
Do home users need EDR?
Not usually. EDR is built for organisations with someone to read its alerts. At home, built-in antivirus, automatic updates, a password manager and multi-factor authentication cover most of the risk.
What is the difference between EDR, XDR and MDR?
EDR watches endpoints (computers and servers). XDR (extended detection and response) adds other sources, such as email, network and cloud logs, to the same investigation. MDR (managed detection and response) is a service in which an outside team watches the alerts for you around the clock.