What is EDR?

An EDR agent runs on every protected endpoint and streams behavioral telemetry, not just file signatures, to a cloud or on-premises backend. Traditional antivirus asks whether a file matches a known-bad signature. EDR asks a broader question: what did this process actually do? It records process creation and parent-child lineage, command-line arguments, files written or modified, registry keys created, DLLs loaded, and every network connection a process opens. That behavioral record is what lets an analyst reconstruct an incident after the fact, replaying exactly what a piece of malware did on a host even if the original binary has since been deleted or the attacker cleaned up after themselves.

Detection combines several layers: signature matching against known-malicious hashes, behavioral rules that flag specific technique patterns, an Office document process spawning cmd.exe, for example, and machine learning models trained on large corpora of endpoint telemetry to catch variations signatures miss. When a detection fires, the agent packages the surrounding context, the full process tree, the command line, related file and registry events, into an alert so the analyst does not start from a blank slate.

Response capabilities are built into the same agent. Analysts can kill a process, quarantine a file, isolate the host from the network while keeping the agent's management channel alive, or drop into a live response shell to run forensic commands directly on the endpoint without physically touching the machine. Leading platforms include CrowdStrike Falcon, SentinelOne, Microsoft Defender for Endpoint, and Carbon Black, each differing mainly in how much of the behavioral analysis happens locally on the agent versus in the cloud backend.

EDR is the foundation most XDR platforms are built on. An XDR product usually starts as an EDR agent and then widens its telemetry intake to network, email, and identity sources, reusing the same endpoint sensor as its most detailed data source.