EDR glossary: terms people confuse, from XDR to MDR to antivirus

EDR means endpoint detection and response: software on laptops and servers that records activity, flags suspicious behavior and lets responders investigate and contain a device. It is often confused with antivirus, EPP, XDR and MDR, which overlap but describe different things. This glossary separates them.

Why do the terms blur?

Vendors bundle products and rename them. A single agent on a laptop may do prevention, detection and response, and the marketing page may use three acronyms for it. The definitions below describe the idea, not any product. Check how a specific product uses a term before you compare.

The terms

Antivirus (AV). Signature and heuristic based blocking of known malicious files. Mostly prevention. Weak at spotting a legitimate tool used badly.

EPP (endpoint protection platform). The prevention side: AV plus things like device control, application control and a host firewall. Think "stop it before it runs."

EDR (endpoint detection and response). The visibility side: it records process starts, network connections, file changes and logins, then lets analysts search that record and isolate a device. Think "show me what happened and let me act."

Telemetry. The raw event stream an agent collects. EDR value depends on which events are collected and how long they are kept.

Detection rule. Logic that turns events into an alert. Rules are often written against behaviors catalogued in MITRE ATT&CK, which describes itself as a knowledge base of adversary tactics and techniques based on real world observations.

Response action. What an operator can do from the console: isolate a host, kill a process, collect a file, roll back changes.

XDR (extended detection and response). The same idea widened beyond endpoints to email, identity, cloud and network data. Definitions vary a lot between vendors.

MDR (managed detection and response). A service. Humans, usually outside your company, watch alerts and respond. It is a staffing decision as much as a tool decision.

SIEM. A system that collects logs from many sources for search, correlation and retention. It is not a replacement for an endpoint agent, and an agent is not a replacement for it.

SOAR. Automation that runs playbooks across tools, such as opening a ticket and isolating a host when conditions match.

Threat hunting. Proactive searching of telemetry for behavior that no rule caught. It needs telemetry and skilled people.

What EDR does not cover

EDR watches a running machine. It does not tell you whether the package you installed was malicious before it ran, which dependency your build pulled, or whether a secret sits in a repository. Those are application and software supply chain questions. Safeguard focuses on that side of the problem and does not replace endpoint tooling.

A constructed example

A developer installs a poisoned package. AV sees nothing, because the files are new. EDR may notice an unusual child process and outbound connection, which is useful. A dependency scan before install would have flagged the package earlier. Neither layer replaces the other.

Which mix ups cause real buying mistakes?

Three confusions show up again and again.

First, "we have EDR" often means "an agent is installed." Coverage is a different fact. If a quarter of servers lack the agent, or it runs in a reduced mode, the dashboard still looks healthy. Ask for a coverage report by device group, not a license count.

Second, buyers assume XDR includes the log retention of a SIEM. Often it does not, or it keeps data for a shorter time. If you need a year of searchable history for audits or investigations, ask for the number and what it costs.

Third, "managed" can mean anything from a team that forwards alerts to one that actually isolates hosts overnight. Get the authority boundary in writing: which actions may the provider take without calling you, and what is the expected time to first action?

A fourth, smaller one: detection rules versus detection coverage. Having ten thousand rules says little. The useful question is which techniques you can detect and which you cannot, which is where a technique matrix helps.

What to do

1. Write down which of these terms your contracts and policies actually use.
2. Ask any vendor to define "EDR," "XDR" and "managed" in their own words, in writing.
3. Decide who responds at 3 a.m.: your staff or a service.
4. Confirm retention length for telemetry, because investigations often start days late.
5. Map endpoint coverage against your supply chain controls so neither is assumed to cover the other.

Quick check

Sources

• MITRE ATT&CK

Definitions here are general usage. Formal vendor and analyst definitions differ and should be checked per product.

Last reviewed: 18 October 2026.