Glossary

#EDR #incident response #detection #endpoint

What is EDR: recording endpoint activity to detect and respond to attacks that get past antivirus

EDR (endpoint detection and response) records device behavior to detect suspicious activity and support response. What it catches that antivirus misses.

Published 2026-06-11 Updated 2026-10-06 6 min read

On this page

Even if you already run antivirus, EDR can still be useful, because the two play different roles. Here's what EDR protects, and how (no attack steps).

How it differs from traditional antivirus

Aspect	Traditional antivirus	EDR
Detection basis	Known signatures / IOCs (hashes)	Behavior / IOAs (a chain of activity)
Slip-through resistance	Weak to fileless / tool abuse	Easier to catch by behavior
After-the-fact investigation	Limited	A timeline to trace what happened
Response	Mostly removal	Supports isolate, investigate, recover

EDR vs XDR vs MDR vs SIEM

These terms often appear side by side in product descriptions. Here they are split by what they do and what they watch.

Term	What it does	What it watches
Antivirus (EPP)	Matches known-bad files and stops them before they run	Endpoints
EDR	Records endpoint activity, detects suspicious chains, helps isolate and investigate	Endpoints
XDR	Extends the EDR idea to email, cloud, network and accounts, and links them	Several areas, endpoints included
MDR	A service where an outside expert team handles detection and response for you	The scope set in the contract
SIEM	Collects logs from many devices and services, and searches, correlates and stores them	Logs across the organization

It helps to think of EDR and XDR as product types, MDR as a way of operating, and SIEM as where the logs live.

How it protects (the mechanism)

1) Continuously record endpoint behavior (processes, network, file ops)

↓

2) Detect a suspicious 'chain of flow' (IOA-based)

↓

3) Isolate the device, investigate via the timeline, recover

EDR records endpoint behavior, detects a suspicious 'flow,' and feeds isolation and investigation.

Signature matching (block known-bad) and behavior detection (notice via IOAs) aren't opposed. Having both is realistic; EDR deepens the latter.

A realistic small-team take

Cover the basics first

Auto-updates, least privilege, CVE monitoring, MFA. Before pricey EDR, the basic measures that keep attacks out and stop them spreading are what help.

Use built-in OS protection

Windows' Microsoft Defender includes light behavior detection. Keep it on and up to date first.

Keep logs and an IOA eye

Retain auth logs, traffic, and processes so you can notice 'a flow that differs from normal' (→ IOA).

Consider EDR as you grow

As the data to protect and device count grow, consider a managed EDR (e.g. Microsoft Defender for Endpoint). Adoption = operation, so pair it with a team that can respond.

Real examples: a public case and a public policy

Osaka General Medical Center (2022): the investigation committee's report lists, as one reason the damage spread across the electronic medical record system, that antivirus wasn't installed on key servers of that system. Detection doesn't work on a device where it isn't installed. With EDR or antivirus alike, the first question is whether any device was left out
The US federal government: on October 8, 2021, the Office of Management and Budget (OMB) issued memo M-22-01, directing federal agencies, under Executive Order 14028, to adopt EDR. The memo describes EDR as combining real-time continuous monitoring and collection of endpoint data with rules-based automated response and analysis

How to check in your own environment

For individuals and small offices, start with the PC in front of you.

In "Windows Security", open "Virus & threat protection" and check that real-time protection is on
Open PowerShell as administrator and run Get-MpComputerStatus | Select-Object AMRunningMode,RealTimeProtectionEnabled,BehaviorMonitorEnabled,AntivirusSignatureLastUpdated. Check that RealTimeProtectionEnabled and BehaviorMonitorEnabled (behavior monitoring) are True, and that the signature update date is recent
If AMRunningMode is Normal, Defender is running as the primary antivirus. If it's Passive, another vendor's product is primary, so check that product is on and up to date

Note that the Microsoft Defender Antivirus built into a PC protects that one machine. It's not the same as a managed EDR that records activity from many devices in one place and can isolate them remotely.

If your organization uses EDR, check three things.

Compare your asset inventory with the device count in the EDR console, and look for devices without it. Servers and connection devices used by contractors are easy to miss
Decide who reviews alerts and when, and who decides to isolate a device at night or on weekends
Confirm that ordinary user accounts can't turn EDR off on their device

This site's view: the 'record/detect/respond' state, not the product name

EDR is powerful, but on this site we don't treat "we have EDR" as "we're safe." Detection is about after an incident starts; the first goal is a design that doesn't let it start or spread (least privilege, patching, MFA, no plaintext secrets). On top of that, since some attacks always slip through, keep a state where you can record, detect, and respond to behavior, sized to your scale. For individuals, "Defender + logs + the IOA mindset" is often enough; for organizations, managed EDR is an option. What matters isn't the product name; it's whether you have both prevention (stopping it) and detection (noticing it).

Sources (primary)

US Office of Management and Budget (OMB), "M-22-01: Improving Detection of Cybersecurity Vulnerabilities and Incidents on Federal Government Systems through Endpoint Detection and Response" (October 8, 2021) — whitehouse.gov (description of EDR and the directive to federal agencies)
Microsoft Learn, "Get-MpComputerStatus" — learn.microsoft.com (command to check Defender's status)
Microsoft Learn, "Endpoint detection and response in block mode" — learn.microsoft.com (Defender's active and passive modes)
Osaka General Medical Center, information security incident investigation committee report (published March 28, 2023) — gh.opho.jp

FAQ

QHow is EDR different from traditional antivirus?

Traditional antivirus mainly matches 'known-bad files' (signatures/hashes) and blocks them. EDR adds continuous recording of on-device behavior (process launches, network, file operations), detects a suspicious chain of activity, and supports the response — isolate, investigate, recover. Think: AV blocks known-bad; EDR notices by behavior and helps you respond.

QWhy is behavior-based detection needed?

Attackers swap file hashes and abuse legitimate OS tools (fileless) to slip past signature matching. Such attacks barely look like a 'bad file' — they show up only as 'an odd chain of behavior.' So EDR, which watches behavior (IOAs), plays the role of catching what slipped through.

QDo individuals or small teams need EDR?

Full EDR is mainly for organizations and is often overkill for individuals/small teams. But the idea is useful. Windows' Microsoft Defender includes light behavior detection, and combining the basics (auto-updates, least privilege, kept logs) with the IOA mindset (notice by behavior) gets much of the value. The state — can you record, detect, and respond to behavior — matters more than the product name.

QWhat's the difference between EDR and XDR?

EDR records activity on endpoints such as PCs and servers to detect and respond to attacks. XDR (Extended Detection and Response) extends the same idea beyond endpoints, to email, cloud, network and accounts, and links records from several places to see them as one attack. EDR watches endpoints only; XDR watches several areas, endpoints included, together.

QWhat's the difference between EDR and MDR?

EDR is a product (a mechanism); MDR (Managed Detection and Response) is a service where an outside expert team does the detection and response for you. EDR alone doesn't stop an attack if nobody reviews the alerts and decides what to do. Organizations without staff who can respond at night and on weekends consider MDR alongside EDR.

QHow do I check that Microsoft Defender is running on my PC?

In 'Windows Security', open 'Virus & threat protection' and check that real-time protection is on. In PowerShell run as administrator, Get-MpComputerStatus shows whether RealTimeProtectionEnabled (real-time protection) and BehaviorMonitorEnabled (behavior monitoring) are True, and whether the signature update date is recent.