EDR (Endpoint Detection and Response) is a technology that records what happens on computers and servers (processes, files, connections, sign-ins) so that suspicious behaviour can be detected, investigated and answered, for example by isolating the device from the network.
How it works
An agent installed on each device sends telemetry to a central console. Unlike a signature-based antivirus that looks for known files, EDR analyses behaviour: an office document that launches a command interpreter and downloads code is a suspicious chain even if no file is on a blocklist.
The console lets an analyst reconstruct the sequence of events and take response actions: isolate the device, end a process, quarantine a file or block an account, depending on the product and licence. MDR (Managed Detection and Response) adds a team of people who review the alerts and act as part of the service. XDR extends the telemetry to identity, email and network.
Example
An illustrative example, not a real case. Someone opens an email attachment on a laptop. The document runs a script that tries to encrypt files in a shared folder. If the EDR recognises the behaviour, it isolates the laptop from the network and raises an alert.
The person responsible reviews the timeline, confirms that no other device shows the same activity, resets the affected user's credentials and checks that the backups of that folder are intact before the laptop is allowed back. The value is not only the alert, but that someone knows what to do with it.
Limits
EDR does not guarantee real-time detection or complete coverage. Devices without an agent, disabled agents, unsupported systems and poorly tuned rules leave gaps; a device that sends no telemetry must not be shown as healthy.
Isolating a device can also interrupt work, so it must be agreed who may decide it. An alert is not a resolved incident: it has to be investigated and closed. And EDR does not replace patching, backups or least privilege. Because it collects user activity, define what is recorded, who can access it and how long it is kept.
When to call an expert
Ask for help when you have hybrid work or laptops outside the office, when nobody reviews alerts every day, when a customer, an audit or an insurer asks for evidence of endpoint protection, or when an incident has already happened.
A preliminary assessment reviews how many devices and servers there are, which users hold privileges, which systems cannot take an agent and who decides to isolate a device. At Impulso Tecnológico we work on diagnosis, technical controls and training, and we approach managed EDR and MDR as part of a cybersecurity strategy: read EDR and MDR for businesses, see our cybersecurity services or tell us about your case.
Learn more
Related glossary terms: MDR, XDR, SOC, SIEM and ransomware.
Official sources: the incident response recommendations in NIST SP 800-61 Rev. 3 and MITRE ATT&CK, a public knowledge base of attacker tactics and techniques.