Hack the Route Start free Open app Detection and response
Endpoint detection and response (EDR)
An agent on each host that records process, file and network activity to detect and help respond to threats.
EDR is an agent on every endpoint that continuously records what processes run, what files change and what connections open, so suspicious behaviour — a rogue process beaconing out, a new persistence entry — is detected and can be investigated or killed centrally. It automates the host-side checks you run by hand in an incident: listing processes, reading dropped files, spotting the beacon, and removing the implant.