What Is EDR (Endpoint Detection and Response)?

EDR is a class of security software that continuously records process, file, and network activity on laptops, servers, and other endpoints, analyzes that record for evidence of attack, and provides the means to investigate and contain whatever it surfaces. The acronym expands to endpoint detection and response.

Within cybersecurity, the acronym is settled, while outside it, the same three letters name the automotive event data recorder, the module that captures vehicle data in the seconds around a crash.

Where the Term Came From

Anton Chuvakin, then an analyst at Gartner, named the category in July 2013, proposing endpoint threat detection and response for tools whose purpose was detecting and investigating suspicious activity, and the traces such activity leaves, on hosts. The middle word fell out of common use within a few years. ETDR and EDR denote the same category.

What the Agent Records

Collection happens through interfaces the operating system provides for the purpose, principally kernel callbacks and Event Tracing for Windows on Microsoft systems and eBPF or audit hooks on Linux. What the agent can see is bounded by what those interfaces expose.

The telemetry usually includes process creation with full command lines and parent-child relationships, file writes, registry modifications, module loads, authentication events, scheduled task creation, and outbound network connections.

Volume and retention period are what make that record useful, since holding weeks or months of it means an investigator can ask what a machine was doing at a timestamp that only became interesting later. The same archive supports threat hunting, where an analyst queries every endpoint for a technique instead of waiting for an alert about one.

Detection, Investigation, and Response

Detection logic consumes the event stream as it arrives. Behavioral rules describe sequences, such as a word processor spawning a scripting engine, or a browser writing an executable that then establishes a connection. Statistical models and threat intelligence indicators supplement the rules, and most platforms group related signals into a single incident, so one intrusion produces one queue item.

The investigation surface that defines EDR security is a reconstruction of past activity, assembled from whatever the agent was recording at the time. Analysts work a process tree backward from the detection to the first action in the chain, then pivot across hosts on a shared binary or destination address. Periods when the agent was uninstalled, disabled, or not yet deployed appear as gaps, so the reconstruction is only as complete as the collection behind it.

The same console executes response actions, with isolating a host from the network while leaving the agent reachable, killing a process, quarantining a file, collecting a memory image, and opening a remote shell making up the common set. A detection rule can also trigger containment directly, without an analyst present to approve it.

How EDR Differs From Antivirus, XDR, and MDR

Retention is the practical line between the first two rows. A blocking control decides and discards, which leaves nothing to query afterward, so an organization running antivirus alone has no way to establish when an intrusion began. The last two rows differ from the second in delivery more than in what is collected, since one endpoint agent commonly feeds a vendor's EDR product, its XDR pipeline, and its managed service. Application detection and response sits outside the table altogether, working inside the application instead of on the host, which the ADR vs EDR comparison takes up. 

Why Governments Made It Mandatory

OMB memorandum M-22-01, issued on 8 October 2021, set deadlines for United States federal agencies on their endpoint tooling. Within 90 days, they had to give CISA access to current enterprise deployments or work with CISA on future-state options, confirm that their chosen solution aligned with the reference architecture, and ensure endpoint data was consolidated, retained, and archived for analysis. The 120-day deadline required an analysis of their own capabilities and of the gaps in what was already deployed.

CISA carried obligations of its own under the same memorandum, including publication of a technical reference architecture, together with a maturity model within 90 days and a deployment playbook within 180. The memorandum states the objective as government-wide insight into activity at the host level, with the capacity to attribute and respond to it coordinated centrally instead of agency by agency.

The Kernel Problem

Visibility of this kind is bought with privilege, and the price of that privilege became public on 19 July 2024. CrowdStrike's own root cause analysis traces the failure to a content update whose field count did not match what the sensor expected, producing an out-of-bounds memory read and a system crash.

Because the sensor ran in kernel space, the failure took down the whole machine, which then would not boot. Remediation began as a per-host task, since a device that will not start cannot receive a fix over the network.

Microsoft put the scope at 8.5 million Windows devices, under one percent of the Windows installed base, and attributed the breadth of the disruption to the number of critical services running on enterprises that had deployed the product.

Microsoft's longer answer was architectural, beginning with a Windows Endpoint Security Ecosystem Summit it convened in September 2024 and running to a commitment to let security products work in user mode, outside the kernel, on a platform that reached private preview by mid-2025.

How Attackers Turn the Agent Off

An agent with that much reach is itself worth attacking, and the shortest route runs underneath it. In a bring-your-own-vulnerable-driver attack, the intruder installs a properly signed driver that carries a known flaw, exploits the flaw to obtain kernel privilege, and from there unloads or blinds the security agent without having to defeat the agent's own code.

Microsoft maintains a vulnerable driver blocklist against this, covering signed drivers whose known flaws an attacker could use to gain kernel privileges on Windows. It has been enabled by default since the Windows 11 2022 update, is refreshed quarterly through Windows updates, and is paired with an attack surface reduction rule that prevents applications from writing such drivers to disk. Both controls sit in the operating system rather than in the security product, because an agent cannot reliably police the layer it runs inside.

What EDR Cannot See

The blind spot sits one layer above where the agent watches, in the territory runtime security covers. An attack that stays inside the application, spawning no process and writing no file, presents the agent with nothing it recognizes as hostile, because the activity occurs within a legitimate process the agent has every reason to leave alone.

Insecure deserialization, server-side request forgery, and injection into a database query all execute inside the normal operation of a web server or application runtime. The agent sees the Java or Node process it has always seen, behaving in a way it cannot interpret, since the meaning of that behavior lives in the application's own objects and call stack rather than in system calls. Closing that gap takes visibility from inside the process.

Raven Runtime ADR instruments the application itself, so an injected query or a hostile deserialization is judged by its effect on the running code, in the place an endpoint agent has no view of. See it at Runtime ADR.

‍