Endpoint Detection And Response (EDR).

What is endpoint detection and response?

Endpoint detection and response, or EDR, is a type of security tool that watches endpoints for suspicious activity. An endpoint is a device such as a laptop, a desktop or a server. The tool is meant to help a security team notice a problem on a device and respond to it.

The name has three parts. Endpoint says where it works. Detection means it looks for signs of an attack. Response means it gives the team a way to act once something is found.

How does EDR work?

An EDR tool usually places a small program, often called an agent, on each device. The agent watches what happens on that device and sends alerts when it sees something odd. Analysts then review the alerts and decide what to do.

CISA describes EDR agents as a way for analysts to hunt actively for intrusions and to remove adversaries before they cause harm. Threat hunting means searching for attackers instead of waiting for an alarm. CISA also says its EDR work lets it run proactive hunts on federal networks.

What does EDR look like in practice?

This is a simple illustration. A device runs a program that it should not run. The EDR agent flags it and raises an alert. A responder reviews the alert and can then use the tool to contain the device.

A CISA advisory on an incident response engagement describes a similar flow. The affected organization used its EDR tool to contain the intrusion once it acted on the alerts.

What can go wrong with EDR?

An EDR tool only helps if people use it well. In that same advisory, CISA lists that EDR alerts were not continuously reviewed. It also says some public-facing systems lacked endpoint protection.

A CISA red team assessment of a critical infrastructure organization found other gaps. The organization relied too heavily on host-based EDR and did not have enough protection at the network layer. The assessment says EDR largely failed to protect the organization, detecting only isolated payloads. It also says a legacy environment had no EDR coverage at all.

The same assessment shows the other side. It says one EDR product stopped payload execution and prevented initial access by phishing, but defenders neither read nor responded to the alert.

How can an organization get more from EDR?

CISA gives these points in its advisory and assessment.

• Review EDR alerts continuously.
• Add EDR to legacy hosts to watch for suspicious activity and to detect breaches.
• Tune host-based products to detect anomalous binaries, lateral movement and persistence techniques.
• Include procedures for expediting EDR deployment in the incident response plan, and test with third party responders and external EDR agents.

A binary is a program file. Lateral movement is when an attacker moves from one system to another. Persistence is how an attacker keeps access after a restart or a login change.

Is EDR the same as a SIEM?

No. EDR focuses on endpoints. A SIEM, or security information and event management tool, collects logs from many sources in one place. The two can be used together, but that is a design choice for each team.

Is EDR only for large organizations?

The CISA pages we read describe federal agencies and a critical infrastructure organization, so they do not answer this for other sizes. The need to watch devices and to review alerts is the same for any team that uses the tool.