Endpoint detection and response

Observe and respond on the device

Endpoint detection and response, often shortened to EDR, combines device telemetry, detection, investigation tools, and response capabilities. Depending on the product and configuration, it may record process execution, file activity, network connections, and other security-relevant behavior. It can also support actions such as isolation, process termination, or evidence collection.

The sensor's presence is not a guarantee of complete visibility. Coverage varies by operating system, configuration, permissions, version, connectivity, and the events the product actually collects. An analyst should understand those limits before treating a console search as an exhaustive history of a device.

Read a process chain carefully

A fictional finance employee opens an invoice document. The endpoint console shows the document reader starting a scripting interpreter, followed by a new executable and an external connection. The sequence is concerning because it connects user-delivered content with unexpected code execution.

The investigator checks the process identifiers, timestamps, command information, file paths, hashes, and connection details. Parent-child relationships provide context, but they should be interpreted alongside other telemetry; naming or lineage alone does not prove malicious intent.

The same interpreter might also support approved automation. Compare the observed chain with the expected application workflow, deployment records, and the employee's report. A signed executable can still be abused, while an unsigned internal tool may be legitimate. Establish the behavior rather than relying on one reputation attribute.

Response commands have consequences

Isolating the device can limit network communication, but exact behavior depends on the tool. Confirm which management or response channels remain available and whether the action was enforced. A pending command for an offline device does not immediately contain it.

Stopping a process may interrupt harmful activity and may also remove volatile evidence. Collect relevant information where practical, while prioritizing ongoing harm. Record the command, approving authority, execution time, and observed result so other investigators can understand changes introduced by the response team.

Device actions do not necessarily revoke cloud sessions or invalidate stolen credentials. Coordinate endpoint findings with identity and service records through Incident response. If credentials may have been exposed, plan the relevant account and session work separately.

Practice with safe telemetry

Use a benign test program in an authorized lab to generate a known process and connection sequence. Locate it in the endpoint console and compare the record with the actions you deliberately performed. Note missing fields and ingestion delay.

Then draft an investigation note explaining what the telemetry establishes and what remains uncertain. Link the device evidence with Logs and telemetry and use Incident containment to reason about when a response action is justified.

Related concepts

• Malware
• Linux processes and services
• Memory forensics