Cybersecurity glossary
What is EDR?
Also known as: EDR, endpoint detection and response, MDR, XDR
Definition
Endpoint detection and response (EDR) software records activity on laptops and servers, detects suspicious behavior and lets responders investigate and contain threats remotely.
Why it matters
Unlike traditional antivirus, which focuses on known malicious files, EDR watches processes, network connections and changes, which helps catch hands-on-keyboard attackers. Its value depends on someone reviewing alerts, which is why small organizations often buy it as a managed (MDR) service.
Common questions about EDR
See also
Sources
Related Guides
GuideSmall Business Security
How to Write an Incident Response Plan Small Business Owners Use
Learn how to write an incident response plan small business teams can execute quickly. Protect operations, contain threats, and recover critical systems.
Read more GuideDetection Engineering
How to Install and Configure Sysmon: Step-by-Step Sysmon Tutorial
Learn how to install, configure, and validate Microsoft Sysinternals Sysmon for Windows endpoint threat detection in this practical sysmon tutorial.
Read more GuideSmall Business Security
10 Small Business Cybersecurity Tips to Reduce Risk Fast
Protect your company with ten practical small business cybersecurity tips. Implement MFA, patch software, secure Wi-Fi, and build backups that work.
Read more GuideSOC
How I Investigate a Suspicious PowerShell Alert in a SOC Lab
A walkthrough of the exact triage workflow, event correlation steps, and command-line decoding techniques used to analyze suspicious PowerShell execution.
Read more