What is endpoint detection and response (EDR) and how does it work?

Endpoint detection and response (EDR) combines continuous monitoring and collection of endpoint data with rules-based automated response and analysis. It records what happens on devices, flags suspicious behavior and lets responders investigate and contain a threat. It adds visibility that traditional antivirus lacks.

What is the official definition?

The US Office of Management and Budget, in memorandum M-22-01 of 8 October 2021, gives a plain one. EDR combines real-time continuous monitoring and collection of endpoint data, for example from workstations, mobile phones and servers, with rules-based automated response and analysis capabilities. The memo says that, compared to traditional security solutions, EDR provides the increased visibility needed to respond to advanced threats such as polymorphic malware, advanced persistent threats and phishing.

It also calls EDR an essential component for moving to zero trust architecture, because every connected device is a potential attack vector. The memo was issued under Executive Order 14028, which directed the federal government to adopt EDR.

How does it work?

An agent on each device records events: process starts, file changes, network connections, logins, registry or configuration changes. That data goes to a central store. Detection logic looks for patterns, such as an office application starting a command shell that then contacts an unfamiliar address. When a rule fires, an analyst gets an alert with the sequence of events around it.

Response actions vary by product, but commonly include isolating a device from the network, killing a process, quarantining a file and collecting forensic data for a closer look.

How is it different from antivirus?

Traditional antivirus mostly asks whether a file looks bad when it arrives or runs. EDR keeps the history and asks whether behavior looks bad over time. That matters when an attacker uses legitimate tools already on the machine, because no malicious file exists to catch.

Many products combine both, so the distinction is about capability, not product labels. What you need to confirm is that the telemetry is rich enough to investigate after the fact, and that someone is watching the alerts.

What does it look like in a constructed case?

A finance employee opens a document from an email. The document starts a script engine, which downloads a tool and starts probing the network. A file scanner sees nothing it recognizes. The EDR sees an unusual parent-child process chain and a new outbound connection from a finance laptop, raises an alert, and the on-call analyst isolates the laptop within minutes. The recorded timeline then shows which files were touched and which accounts were used.

Without the history, the team would know a laptop acted strangely and little else.

How to check or apply this

1. Decide the goal: earlier detection, faster containment, better investigations, or a compliance requirement.
2. Cover all endpoint types you own: laptops, servers, cloud workloads and, where possible, phones.
3. Confirm who monitors alerts and when. An alert nobody reads is the same as no tool.
4. Write response playbooks for the common cases: suspected malware, stolen credentials, ransomware precursors.
5. Test detection with safe, known techniques and check which ones raise alerts. MITRE ATT&CK catalogs adversary techniques by tactic and gives you a shared way to describe coverage.
6. Decide data retention. Investigations of slow intrusions need history longer than a week.
7. Plan device performance and privacy checks with staff, since agents see detailed activity.
8. Review agent health weekly: devices that stopped reporting are blind spots.

What does EDR not do?

It does not see inside cloud consoles, SaaS applications or devices without an agent. It does not fix missing patches or weak configuration. It can produce many false alerts until tuned. And it does not decide policy: someone must choose when isolating a device is acceptable.

Quick check

Sources

• OMB M-22-01: Improving Detection of Cybersecurity Vulnerabilities and Incidents on Federal Government Systems through Endpoint Detection and Response
• MITRE ATT&CK Enterprise Matrix
• NIST CSRC glossary: Endpoint Detection and Response

Last reviewed: 18 October 2026.