Understanding EDR

Endpoint Detection and Response (EDR) gives security teams detailed visibility into activity on computers and servers so they can detect suspicious behaviour, investigate what happened, and take controlled response actions.

What you will learn

By the end, you should be able to explain how endpoint activity becomes a detection, trace the main EDR workflow, distinguish EDR from antivirus and DFIR, and choose a proportionate response supported by evidence.

What is EDR?

Core concept

EDR records selected activity on laptops, desktops, and servers. It connects programs, files, users, settings, and network activity so analysts can detect suspicious behaviour, reconstruct what happened, and respond safely.

ProcessesFilesUsersConnectionsResponses

Keep in mind: EDR supports endpoint security but does not prevent every compromise. It depends on healthy agents, useful telemetry, tested detections, suitable retention, and analysts who validate the evidence.

01EndpointA monitored laptop, desktop computer, or server 02TelemetrySelected activity recorded by the endpoint agent 03ContainmentA controlled action that limits further harm

What EDR is not

EDRRecord, detect, investigate, and respond on endpoints

AntivirusPrevent or remove common known threats

DFIRInvestigate and recover across the wider incident

SIEMCorrelate endpoint evidence with other systems

HardeningReduce the opportunities available to an attacker

Connected, but not interchangeable

EDR provides detailed endpoint evidence and response actions. It does not replace identity protection, network monitoring, backups, recovery planning, or specialist forensic acquisition.

Events, detections, alerts, and incidents

01EventA process start, file change, sign-in, or connection recorded by the agent

→

02Detection and alertSelected activity matches a rule or behaviour that requires review

→

03IncidentInvestigation confirms or manages a security issue using wider context

An alert is not proof

Validate the connected activity, collection coverage, and business context before declaring an incident or taking a disruptive action.

Why EDR matters

Improve endpoint visibility

Record useful device activity so analysts can investigate events that would otherwise be short-lived or difficult to reconstruct.

Connect related activity

Link programs, files, users, settings, and connections to reveal a sequence that may not be suspicious when each event is viewed alone.

Detect suspicious behaviour

Apply tested rules and behaviour checks to identify activity that warrants analyst review.

Respond with context

Help analysts preserve evidence, contain confirmed risk, verify the result, and record what changed.

How EDR works

1. CollectRecord selected endpoint activity and confirm that the agent and timestamps are healthy.
2. ConnectLink programs, files, users, settings, and network activity into an activity story.
3. DetectApply rules and behaviour checks to identify activity that requires review.
4. PrioritiseAdd device, user, prevalence, and business context to focus analyst attention.
5. InvestigateTest possible explanations against endpoint, identity, network, and incident evidence.
6. RespondUse an approved action that matches the evidence, urgency, and operational impact.
7. Verify and improveConfirm the result, record the outcome, and improve detection and response guidance.

EDR products use different detection methods. These may include shared rules, known warning signs, behaviour patterns, statistical models, or machine learning. No method guarantees detection or prevention, and every result still needs suitable validation.

What EDR records

EDR may record program starts and parent-child relationships, file changes, sign-ins and permission use, services and startup settings, network connections, detections, and response results. Analysts connect these records by device, user, process, file, destination, and time to reconstruct activity.

The exact telemetry depends on the product, operating system, configuration, permissions, and agent health. Missing or delayed records can change an investigation conclusion, so collection coverage and timestamps must be checked before relying on the evidence.

Investigate endpoint activity

One event may look harmless. A connected sequence can tell a different story. In this guided lab, you are the first analyst reviewing an alert from a finance laptop.

Try it: investigate a suspicious endpoint

Open each evidence record, decide what the sequence supports, and choose the safest first response. Everything is synthetic and no software is required.

Training alertCase EDR-1042

Stage 1 of 4Decisions 0/3

High priorityNot yet confirmed

Suspicious child process from an Office document

Invoice document launched hidden PowerShell

A rule detected an unusual program relationship on a finance laptop. Your task is to determine what the available evidence supports—not to guess beyond it.

Device

FIN-LT-22

User

j.lee

First seen

10:14

Agent

Healthy

Acknowledge and investigate

1. 1Review alert
2. 2Inspect evidence
3. 3Assess
4. 4Respond

2 Inspect and connect the evidence

Open all six records, then select only those that help explain the alert. Two records are normal background activity.

10:14:03ProcessWINWORD.EXE → powershell.exeOpen record

10:14:05Fileupdate.ps1 created in TempOpen record

10:14:08PersistenceOfficeUpdate task createdOpen record

10:14:11NetworkPowerShell connected externallyOpen record

09:58:22SoftwareChrome updater completedOpen record

10:12:41User activityOneDrive synced budget.xlsxOpen record

Locked

Acknowledge the alert to begin reviewing records.

3 Choose the most defensible assessment

Select the conclusion supported by the records. Severity alone is not proof.

Malware is confirmedThe unknown script proves malicious intent and impact Suspicious chain needs containmentEvidence supports escalation; intent, file purpose, and wider scope remain unconfirmed Monitor without containmentThe chain is suspicious, but wait for another alert before acting

Select the relevant evidence to unlock this decision.

4 Build the response plan

The endpoint is online and the connection may be active. Put containment, evidence, wider scope, and verification into the plan.

1 ContainChoose the first action…Leave connected and monitorIsolate FIN-LT-22 from the networkShut down the laptop 2 PreserveChoose how to protect evidence…Delete update.ps1Restart and run a full scanKeep powered on and collect volatile evidence 3 Check scopeChoose the wider check…Investigate this endpoint onlyProtect j.lee and review other sign-insDisable every Finance account 4 VerifyChoose how to verify…Assume the action workedClose the alert immediatelyConfirm isolation and record the action result

Escalation note Check response plan

Record a supported assessment to unlock the response plan.

What makes EDR useful

Start with an endpoint question

Can we detect a document starting an unexpected command tool?

1. 1Select telemetryIdentify the endpoint records needed to answer the question.
2. 2Verify coverageCheck agent health, timestamps, fields, and retention.
3. 3Test detectionConfirm controlled activity produces the expected signal.
4. 4Guide responseDocument what analysts should validate, do, and record.

!Plan for operational friction

Missing agentsDelayed eventsNoisy rulesShort retentionUnclear ownershipUntested actions

Measure coverage, agent health, telemetry delay, detection quality, investigation time, and response success rather than alert volume alone.

Match the response to the risk

Isolation, process termination, and quarantine can disrupt operations or destroy useful evidence. Follow approved procedures, consider identity and wider incident scope, and test automated actions with narrow conditions, approval boundaries, verification, and rollback. Remember that offline devices, unhealthy agents, retention limits, and false detections create visibility gaps.

Endpoint and forensic tools in this kit

The tools in this section support different parts of the endpoint investigation workflow. They are not equivalent enterprise EDR products.

Focused Windows monitoring

Aurora Lite

Choose it when: You want to practise Windows endpoint telemetry using defined rules and known warning signs.

Evidence: Windows activity collected through Event Tracing for Windows.

Strength: Lightweight telemetry, Sigma-based detections, indicators, and configured response actions.

It is narrower than a full enterprise EDR platform. Confirm supported systems, permissions, updates, exclusions, logs, and performance. Targeted forensic collection

Velociraptor

Choose it when: You need targeted artefacts, repeatable endpoint queries, or hunts across several systems.

Evidence: Host artefacts collected to answer investigation questions.

Strength: Flexible collection, remote queries, repeatable hunts, and forensic workflows.

Treat it as an endpoint visibility and collection platform. Plan access, evidence storage, query impact, retention, and audit records.

Choose one evidence path first

Start with Aurora Lite for Windows telemetry and detection, or Velociraptor for targeted collection and deeper investigation. Add a tool only after defining the evidence and decision the lab must support.

Continue learning

• Explore Aurora Lite for Windows endpoint monitoring with Sigma rules.
• Explore Velociraptor for endpoint artefact collection and forensic hunting.
• Understand DFIR to review evidence handling and the wider incident process.
• Understand SIEM to see how endpoint alerts can be combined with identity, network, and application data.