Endpoint Detection and Response (EDR) is an emerging technology. The term defines a category of tools and solutions that focus on detecting, investigating, and mitigating suspicious activities and issues on hosts and endpoints. Originally dubbed Endpoint Threat Detection and Response (ETDR), the term is now more commonly referred to as Endpoint Detection and Response (EDR).

A rapidly growing field, there are numerous software tools focused on endpoint detection and response as well as tools and solutions with broader offerings that include endpoint detection and response as a core or supplemental capability. Digital Guardian is recognized by industry analysts as a leading provider of endpoint detection and response solutions.

WHY ENDPOINT DETECTION AND RESPONSE MATTERS?

Advanced persistent threats and customized targeted malware attack toolkits are intentionally bypassing traditional signature-based antivirus solutions. Endpoint detection and response solutions enhance traditional signature-based technologies to provide richer behavior-based anomaly detection and visibility across endpoints.

Endpoint detection and response tools offer greater visibility into endpoint data that are relevant for detecting and mitigating advanced threats, limiting sensitive data loss, and reducing the risk of devastating data breaches occurring on endpoints.

Endpoint detection and response tools complement a wide range of other security measures and solutions, including data loss prevention (DLP) solutions, security information and event management (SIEM), network forensics tools (NFT), and advanced threat defense (ATD) appliances.

Key Components of EDR Security

EDR security functions as an integrated Centre for collecting, correlating, and analyzing endpoint data, as well as coordinating alerts and responses to immediate threats. EDR tools have three basic components:

Agents for collecting data at endpoints: Endpoint monitoring is performed by software agents, which collect data such as processes, connections, the volume of activity, and data transfers into a central database.

Automated response: An EDR solution's pre-configured rules can detect when incoming data signals a known type of security breach and initiate an automatic response, such as logging off the end-user or sending an alert to a staff person.

Analysis and forensics: An endpoint detection and response system may incorporate both real- time analytics, for rapid diagnosis of threats that do not quite fit the pre-configured rules, and forensics tools for threat hunting or conducting a post-mortem analysis of an attack.

• A real-time analytics engine searches for patterns by evaluating and correlating enormous amounts of data.

• Forensics tools allow IT security professionals to review previous breaches in order to better understand how an attack operates and how it breached security. IT security professionals also employ forensics tools to discover dangers in the system, such as malware or other exploits that may be hiding on an endpoint.