EDR Explained: Endpoint Detection and Response for Security+ and CySA+

EDR — Endpoint Detection and Response — continuously records what happens on endpoints, detects malicious behaviour, and gives responders the ability to investigate and act without physically touching the machine. It is the successor to traditional antivirus, and the difference between the two is the thing exams test.

Antivirus asks "is this file known to be bad?" EDR asks "is this behaviour wrong?" — and records everything so you can answer that question after the fact.

Why Signatures Stopped Being Enough

Signature-based antivirus matches files against a database of known malware hashes and patterns. That works well against known threats and fails against three things that now dominate:

• Polymorphic malware that changes its hash on every build, so the signature never matches.
• Zero-days, which by definition have no signature yet.
• Living-off-the-land attacks, which use legitimate built-in tools — PowerShell, WMI, PsExec, certutil — and install no malicious file at all. There is nothing for a scanner to find because nothing malicious was written to disk.

That third category is the decisive one. An attacker using PowerShell to enumerate the domain is running a signed Microsoft binary doing something it is fully entitled to do. Only the behaviour is wrong.

What EDR Actually Does

Continuous telemetry collection. An agent records process creation and the parent-child chain, command lines, file and registry changes, network connections, loaded modules, and authentication events. This is the foundation — everything else depends on having the recording.

Behavioural detection. Rules and models look for patterns rather than files: a Word document spawning PowerShell, a process reading the memory of the credential store, a service binary writing to a startup location, a browser making an outbound connection with no user interaction.

Threat hunting. Analysts query the historical telemetry directly. "Show me every host where certutil downloaded a file in the last 30 days" is a question you can only ask if the data was already being collected.

Response actions, performed remotely: isolate the host from the network while leaving the analyst's connection open, kill a process, quarantine a file, collect a memory image, or run a remediation script.

Root cause analysis. Because the process tree is recorded, an investigator can trace backwards from the detection to the original entry point — which attachment, which click, which vulnerable service.

That host isolation capability deserves emphasis. It is what turns a detection into containment in seconds rather than the hours it takes someone to walk to a desk, and it is the single most valuable operational feature.

EDR, XDR, MDR and the Rest

Term	What it covers
Antivirus / EPP	Prevention on the endpoint — signatures, heuristics, blocking
EDR	Detection, investigation and response on the endpoint
XDR	The same idea extended across endpoint, network, identity, email and cloud
MDR	Managed detection and response — a service, someone else's analysts running it
NDR	Network detection and response
SIEM	Log aggregation and correlation across everything
SOAR	Automating the response workflow across tools

Two distinctions worth having ready. MDR is a service, not a technology — it is EDR or XDR with a provider's SOC attached, and it is the common answer for organizations without staff to watch alerts around the clock. And EDR is endpoint-scoped while XDR is cross-domain; if a question emphasizes correlating endpoint activity with email and cloud sign-ins, it is describing XDR.

In practice EDR and SIEM work together: EDR provides deep endpoint context, the SIEM correlates it with network flow, firewall and identity data, and SOAR automates what follows.

What EDR Is Good At — and Where It Falls Short

It is strong on insider activity, fileless attacks, lateral movement, ransomware behaviour before encryption completes, and providing the evidence trail an investigation needs.

The honest limitations:

• It requires an agent, so unmanaged devices, IoT, printers, OT systems and personal BYOD endpoints are invisible. Coverage gaps are the most common real-world weakness.
• It generates a large volume of alerts and needs tuning and staff. An unmonitored EDR is an expensive log collector.
• Attackers target the agent. Disabling or blinding EDR is a standard step in modern intrusions, which is why tamper protection and alerting on agent health matter.
• Performance and storage cost are real, particularly the telemetry retention that makes hunting possible.

Security+ (SY0-701) Exam Tips

• EDR uses behavioural detection; antivirus uses signatures. The central distinction.
• It detects fileless and living-off-the-land attacks that signature tools cannot see.
• Host isolation is the response capability to know by name.
• Know EDR vs XDR vs MDR — endpoint, cross-domain, and managed service.
• It requires an agent, which is its coverage limitation.
• Know the neighbours: EPP, DLP, HIDS/HIPS, NAC, and SIEM.

CySA+ Angle

CySA+ (CS0-004) goes deeper: reading process trees to establish root cause, using EDR telemetry to scope an incident across hosts, recognizing living-off-the-land binaries, and using the platform's own query language for threat hunting. Expect scenarios where the answer is "check the parent process" — a web server spawning a command shell being the textbook example.

Key Takeaways

• EDR continuously records endpoint activity and detects on behaviour rather than signatures.
• It catches fileless and living-off-the-land attacks that leave no file to scan.
• Host isolation turns detection into containment in seconds.
• XDR extends the model across domains; MDR adds someone else's analysts.
• Agent coverage gaps are the main weakness, and attackers actively try to disable the agent.
• It complements rather than replaces a SIEM.