EDR: What It Does and Doesn't Do

Endpoint detection and response (EDR) has become a baseline expectation for organizations of almost every size. It is a significant improvement over traditional antivirus, and it often provides the most useful evidence during an investigation. It is also frequently misunderstood. Organizations deploy it, see a dashboard full of green, and assume they are covered.

Knowing what EDR does well, and where it stops, helps you get value from it and avoid relying on it for things it cannot do.

EDR versus antivirus

Traditional antivirus focuses on recognizing known malicious files, usually through signatures. EDR adds two things:

• Continuous telemetry. EDR records process launches, command lines, network connections, file changes, registry changes and other activity on each endpoint, and sends it to a central platform.
• Behavioral detection. Instead of only matching known files, EDR looks for suspicious behavior, such as an office document launching a scripting engine, credential dumping or unusual use of legitimate administration tools.

That matters because many modern intrusions use legitimate tools and stolen credentials rather than obvious malware. Many EDR products map their detections to MITRE ATT&CK techniques, which helps analysts understand what stage of an attack they may be looking at.

Response actions

The "response" in EDR refers to actions defenders can take remotely, often within minutes:

• Isolating a host from the network while keeping its connection to the EDR console.
• Killing processes and quarantining files.
• Collecting forensic data, such as files, memory or logs, for investigation.
• Running scripts or commands to investigate or remediate.

These capabilities are powerful, which also makes the EDR console a high-value target. Protect it with phishing-resistant MFA, limit who can use live response, and log every action taken.

What EDR doesn't do

It doesn't cover what it isn't installed on. Unmanaged laptops, legacy servers, network appliances, printers, operational technology and many cloud services have no agent. Attackers have increasingly targeted edge devices such as VPN gateways and firewalls partly because they sit outside EDR coverage.

It doesn't see everything in identity and cloud systems. A compromised Microsoft 365 account or a malicious OAuth application may never touch an endpoint. Those threats need identity and cloud audit logging.

It can be disabled. Attackers with administrative access try to uninstall or blind EDR agents. Use tamper protection, and alert when agents stop reporting.

It doesn't fix the underlying problem. EDR can stop a technique, but unpatched vulnerabilities, excessive privileges and weak configurations still need hardening work.

Coverage and configuration

Measure coverage against your asset inventory, not against the EDR console's own device list. The systems missing from the console are the ones that matter. Check also that policies are consistent: devices left in audit-only or detection-only mode after a pilot, or broad exclusions added to fix a performance problem, quietly reduce protection.

Tuning is never finished

Out of the box, EDR will alert on legitimate administrative scripts, software deployment tools and security scanners. Tuning reduces that noise so real alerts stand out. Done carelessly, it creates blind spots: an exclusion for an entire directory or tool can become exactly the place an attacker hides. Document each exclusion, scope it as narrowly as possible, and review it periodically.

Someone has to watch the alerts

EDR generates alerts at all hours, and many intrusions progress fastest outside business hours. An alert that sits unread until Monday morning provides little protection. Decide who triages alerts, how quickly, with what authority to isolate a host, and how they escalate to incident response. For many organizations, a managed security service is the practical way to provide that coverage around the clock.

EDR telemetry is also valuable for proactive threat hunting, which looks for attacker activity that did not trigger an alert.

Frequently asked questions

Do we still need antivirus if we have EDR? Most EDR products include preventive antivirus capabilities. Check that prevention is enabled, not only detection.

Is EDR enough for monitoring? No. Combine it with identity, cloud, network and application logs so you can see activity that never touches a managed endpoint.

How CDT can help

CDT helps organizations deploy, tune and monitor EDR, and our hunt and response teams use its telemetry to find and contain attackers that alerts alone would miss.