cybersecurity Glossary

What is EDR?

An EDR is a new generation antivirus. The acronym for EDR, Endpoint Detection and Response, indicates the main purpose of this technology, to detect and respond to a security threat.

EDR is software that is installed on a computer and monitors all system activity. Unlike a traditional signature-based antivirus, EDR analyses the behaviour of the software running on the system and detects threats, for example detecting unknown malware not classified by other antivirus engines.

It is common for EDR software to collect telemetry, that is, the detail of all disk, memory or system process activity and send it to a server in the cloud. The search among this telemetry of unknown threats is what is called Threat hunting.

Threat Hunting: A managed service focused on the proactive detection and containment of threats and suspicious activity on the network, leveraging telemetry generated by EDR and XDR technology and using the methodology defined in the MITRE ATT&CK framework.