The Endpoint Detection and Response (EDR) is a platform deployed on an
organization’s own infrastructure rather than on cloud-based environment. It is a system designed to protect the endpoints from the network from potential cyber threats. EDR helps detect and responds to the threats that may evade the traditional antivirus and other security solutions deployed at the endpoint.
Workflow:
- Monitoring Endpoints: Monitors any potential threat on the endpoints in the network by using an elaborate set of rules.
- Alerts: Once an event triggers a rule, an alert gets generated in the system.
- If an Action Policy is defined for the alert, then an action gets triggered in real time for the alert to help respond to the alert.
- Incident: An alert is also sent to the central console where one or more alerts get correlated to form an incident. It represents any suspicious activity on the endpoint that has to be investigated.
- Threat Hunting: The EDR then searches for the potential threats that might have invaded the system.
- Response and Remediation: Once the threat is identified via Incident analysis, the analyst then takes further response and remediation actions to mitigate it, such as kill a process based on the alert, quarantine the endpoint, or isolate the endpoint.