What is Endpoint detection and response?
In short
Endpoint detection and response (EDR) software runs on laptops, servers and other devices, monitoring their behavior to detect threats that traditional antivirus misses and helping staff investigate and contain them.
Key takeaways
- It can isolate an infected device from the network.
- It records activity that helps reconstruct how an attack happened.
- Alerts still need people or a managed service to review them.
Where it's tested
ISC: Incident Response & Monitoring — study notes, a five-minute revision sheet and practice questions.
Practise: 3 questions
Question 1 of 3 · 0 answered
A company can tolerate losing at most 15 minutes of transaction data in a disaster. Which metric does this define, and what does it drive?