Learn in the textbookAdvanced Threat Protection and Network Architecture / Communication Security
DefinitionEDR continuously records and monitors activity on endpoints (エンドポイント), meaning the PCs, servers and other devices at the edges of a network, and after an intrusion it detects suspicious behavior and helps with the response.
ExplanationTraditional antivirus software mainly blocks intrusions by matching files against the signatures of known malware. EDR assumes a breach may happen anyway and uses behavior-based detection (振る舞い検知), which watches what programs actually do, so it can notice attacks whose signatures are not yet known and limit the damage early. When it finds suspicious activity, the device is cut off from the network and the records are used to investigate the cause and scope.
AnalogyThink of a security guard patrolling inside a building. Apart from the locks on the entrance, when the guard notices something odd inside, they shut the room and rewind the camera footage to investigate.
Memory hookShort for Endpoint Detection and Response. The D (detection) and R (response) show that it is about finding and dealing with threats rather than keeping them out.