Internship
Student login
← SOC & SIEM learning path
SOC & SIEM · Module 6 of 10

Endpoint detection and response

Protect and investigate devices.

📖 Key ideas

  1. EDR monitors endpoint processes, files, network and registry activity.
  2. Detects suspicious behaviour and can isolate devices.
  3. Examples: Microsoft Defender for Endpoint, CrowdStrike, SentinelOne.
  4. XDR extends detection across endpoint, email, identity, cloud.
  5. Endpoint telemetry is key for investigations.
💡 Real-life example: EDR is a security camera inside every laptop, recording what programs do.
EDREndpoint Detection and Response
XDRExtended Detection and Response
IsolationCutting a device off the network
TelemetryDetailed activity data