Endpoint Detection and Response (EDR)

What Endpoint Detection and Response (EDR) means in practice

Traditional antivirus asks whether a file matches something known to be bad. EDR asks whether the behaviour on a device looks like an attack, regardless of whether any individual file is recognised. That distinction matters because modern intrusions frequently use legitimate tools — PowerShell, remote management software, built-in Windows utilities — in illegitimate sequences.

An EDR agent records telemetry: process creation and lineage, command lines, file writes, registry changes, network connections and credential access attempts. Behavioural analytics and threat intelligence run over that stream to raise detections. When something fires, the recorded timeline lets an analyst reconstruct the intrusion — which document was opened, what it spawned, where it connected, what it touched — rather than guessing from a single alert.

Response capability is the other half. A useful EDR platform can isolate a device from the network while leaving the management channel open, kill processes, quarantine files, collect a forensic package, and run automated remediation. Microsoft Defender for Endpoint provides all of this, along with attack surface reduction rules, device control, and vulnerability management that shows which unpatched software is actually exposed.

The Essential Eight does not name EDR explicitly, but the capability underpins several of its strategies in practice, and cyber insurers increasingly ask for it by name. Managed detection and response services are essentially EDR plus the analysts to operate it, which is how most mid-sized organisations consume it.

Two deployment realities are worth planning for. Coverage gaps — unmanaged contractor laptops, servers excluded from the rollout, devices that fell out of Intune enrolment — are where intrusions persist. And tuning is ongoing: line-of-business applications that behave unusually will generate detections, and suppressing them correctly, rather than broadly, is what keeps the platform trustworthy.