What Is Endpoint Detection and Response?

Endpoint detection and response records detailed activity on workstations and servers — process execution, file changes, network connections, registry and configuration modification — and provides both detection against that activity and the ability to act on the machine remotely.

It replaced signature-based antivirus as the primary endpoint control because modern attacks frequently involve no malicious file at all, only legitimate tools used for illegitimate purposes.

Behaviour, not signatures

Traditional antivirus asked whether a file matched something known bad. That question fails against fileless techniques, against tooling already present on the system, and against any payload recompiled to change its hash.

Behavioural detection asks whether a sequence of actions is suspicious — a document process spawning a scripting engine that reaches out to an unfamiliar address is anomalous regardless of what files are involved.

The response half is what distinguishes it

Network isolation of a single machine, process termination, file quarantine and remote shell access all become possible without physically reaching the device. In an estate where users are distributed, that is the difference between containing something in minutes and arranging for a laptop to be brought in.

Isolation is the single most valuable capability, and the authority to use it is worth settling in advance rather than during an incident.

Retrospective search

Because activity is recorded rather than only evaluated, a newly learned indicator can be searched across historical data. When a vulnerability or campaign is disclosed, the question of whether you were already affected becomes answerable in minutes.

That capability depends on retention, which is frequently set to the shortest supported window for cost reasons, and is worth examining before it is needed.

Coverage gaps and where they are

Servers are frequently less well covered than workstations, because agents were deployed through desktop management tooling that never reached the server estate. Legacy operating systems may not support an agent at all. Network appliances, industrial controllers and embedded systems generally cannot run one.

Those uncovered systems are where a patient attacker will choose to live, which makes the inventory of what has no agent more interesting than the deployment percentage.

It needs someone watching it

The platform generates detections that require human judgement. Deployed without a monitoring function, it produces alerts nobody triages, which is the most common way the investment is wasted.

This is the reason managed detection exists as a category — the tooling is available to anyone and the analyst capacity is the constraint.

Detection mode and prevention mode

Most platforms can either alert on suspicious behaviour or block it outright. Blocking is stronger and carries the risk of stopping legitimate work, particularly for developers, engineers and anyone running unusual tooling.

The workable sequence is to run in detection mode long enough to build exclusions from your own environment, then enable blocking for the high-confidence detection categories and leave the ambiguous ones on alert. Enabling full prevention on day one produces a wave of blocked legitimate activity and pressure to disable the product, which is a worse outcome than a slower rollout.

Where to start

List the systems with no agent and check your retention window. Those two facts bound what the platform can tell you during an incident.

See advanced threat hunting with EDR. GuardsArm delivers managed detection and response.