Endpoint detection and response (EDR) software is the newest member of the endpoint security family. EDR tools combine elements of both endpoint antivirus and endpoint management solutions to detect, investigate, and remove any malicious software that penetrates a network’s devices. EDR solutions give greater visibility of a system’s overall health including each specific device’s state. Companies use these tools to mitigate endpoint penetrations quickly and prevent data loss, theft, or system failures. They are typically used as a complement to larger security systems such as security information and event management (SIEM), vulnerability management, and incident response tools.
The best EDR software solutions record and store system behaviors, employing various data analytics techniques to identify suspicious activities. They also provide contextual information, block malicious actions, and offer remediation suggestions to restore affected systems.
To qualify for inclusion in the Endpoint Detection and Response (EDR) category, a product must:
Alert administrators when devices have been compromised
Search data and systems for the presence of malware
Possess analytics and anomaly detection features
Possess malware removal features