EDR, XDR & Detection Types

1🖥️ EDR

EDR (Endpoint Detection and Response) covers Windows laptops, Windows servers, Linux systems, macOS devices, virtual machines, and cloud workloads. Traditional antivirus asked one question: is this file known to be malicious? EDR asks a much bigger one: what is happening on this device?

Traditional antivirus leaned heavily on known malware signatures — File hash: abc123... → Known malware: Trojan.Generic → Action: Quarantine. Modern EDR adds behaviour analysis, machine learning, process monitoring, memory analysis, exploit prevention, script monitoring, network telemetry, cloud reputation, and attack-behaviour detection on top of that. Just as importantly, it gives analysts investigation capability, not just a verdict:

WINWORD.EXE
     |
     +--- powershell.exe
               |
               +--- rundll32.exe
                        |
                        +--- outbound network connection

That process tree alone gives an analyst far more context than simply knowing a suspicious executable existed somewhere on the disk — it shows the whole chain of custody from the document that started it all.

An EDR sensor typically collects process creation and command lines, file creation, registry activity, network activity, DLL loading, user activity, persistence (scheduled tasks, new services), remote authentication, script execution, and memory behaviour like code injection — enough to let an analyst reconstruct an attack as a sequence of events rather than a single isolated verdict.

2🛡️ Common Platforms & Response Actions

You're likely to meet Microsoft Defender for Endpoint, CrowdStrike Falcon, SentinelOne Singularity, Palo Alto Cortex XDR, Trend Micro, Sophos, Trellix, VMware/Carbon Black, or Elastic Defend. Defender for Endpoint sits inside Defender XDR alongside identity, email and cloud-app signals; CrowdStrike Falcon and SentinelOne/Cortex all provide endpoint behaviour detection plus automated response.

EDR does more than observe. Depending on permissions and product, an analyst may be able to isolate a device, terminate a process, quarantine or delete a file, collect forensic information, retrieve files, run remote investigation commands, or block hashes/indicators:

Employee laptop compromised → SOC confirms malware
   → EDR isolates device → Network communication blocked
   → Incident Response investigates

Isolation is particularly useful because the endpoint often stays manageable by the security platform even while normal network connectivity is blocked — the analyst doesn't lose visibility just because the attacker lost network access.

3⌛ Legacy Endpoint Security

Before EDR, companies mostly ran traditional antivirus, Host Intrusion Prevention Systems (HIPS), personal firewalls, application control, and Host Intrusion Detection (HIDS) — older deployments of Symantec Endpoint Protection, McAfee/Trellix, Trend Micro OfficeScan, Microsoft System Center Endpoint Protection, or Sophos still turn up in real environments.

Legacy servers sometimes simply can't support a modern EDR agent:

Windows Server 2008 running legacy financial application
        |
        +---- cannot install modern EDR
        |
        +---- business says server cannot be replaced

The SOC compensates with network monitoring, firewall rules, IDS, centralised Windows logging, application logs, and network segmentation — a compensating control, the same concept Module 8 introduced for legacy technology generally.

4📡 XDR

XDR (Extended Detection and Response) correlates information across multiple security domains — endpoint, identity, email, cloud, SaaS, network — rather than looking at endpoints alone. Microsoft describes Defender XDR as correlating signals across endpoints, identities, email and applications; Palo Alto describes Cortex XDR similarly, pulling from endpoint, network, cloud and identity data instead of endpoint telemetry alone.

Why XDR exists

A phishing attack, seen through four separate lenses: email security sees a malicious email delivered; identity security sees a sign-in from an unusual location; endpoint security sees a browser download an executable; the firewall sees the laptop talking to a suspicious IP. A traditional SOC might receive four unrelated alerts. XDR correlates them into one incident instead:

INCIDENT #45821 - Possible account and endpoint compromise
User: alice@example.com   Device: LON-LT-2847
Email: Malicious attachment
Identity: Suspicious authentication
Endpoint: PowerShell execution
Network: Communication with malicious infrastructure

Which is dramatically more useful to an analyst than four disconnected tickets they'd otherwise have to manually stitch together themselves.

5⚖️ SIEM vs EDR vs XDR vs SOAR

The boundaries are increasingly blurred — Elastic Security combines SIEM, XDR, endpoint and cloud security in one console; Google Security Operations combines SIEM, SOAR and threat intelligence. Don't expect a clean, single-purpose product per row of that table in a real environment.

6🎯 How Detections Actually Work

A detection rule can spot an attacker several fundamentally different ways.

7🎯 MITRE ATT&CK

One of the most important frameworks in SOC work is MITRE ATT&CK — a knowledge base describing adversary tactics and techniques drawn from real-world attacker behaviour. Instead of thinking only "malware detected," SOC teams think in terms of attacker objectives:

MITRE's Enterprise ATT&CK matrix currently lists fifteen enterprise tactics in total, giving SOC teams (and vendors, and this course) a shared vocabulary for describing what an attacker is actually trying to do at any given step.

8🔧 Detection Engineering & Sigma Rules

Large SOCs employ Detection Engineers to design and tune detection logic. A first attempt at a PowerShell detection might be as simple as ProcessName == powershell.exe — which would generate thousands of alerts, since PowerShell is used constantly by administrators, developers, deployment tools, backup software, and monitoring tools. It needs refining:

Process = powershell.exe
AND CommandLine contains:
  -EncodedCommand OR DownloadString OR FromBase64String

Modern teams increasingly manage detections as code. Sigma is an open, YAML-based detection format that describes a detection independently of any one SIEM, then translates into Splunk, Elasticsearch, or Sentinel queries:

title: Suspicious Encoded PowerShell
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\powershell.exe'
    CommandLine|contains: '-EncodedCommand'
  condition: selection
level: high

You don't need to become a Sigma expert immediately — just understand that organisations increasingly manage detections like software: Detection rule → Git repository → Peer review → Testing → Production deployment. Sigma also lets authors explicitly document expected false positives right in the rule, which shows how closely detection development and detection tuning are actually connected.

Lesson Outcome

You should now be able to explain what EDR adds beyond traditional antivirus, why XDR correlates across domains instead of watching endpoints alone, name the seven detection approaches and pick the right one for a given scenario, use MITRE ATT&CK tactic names to describe attacker objectives, and explain why detection engineering is iterative. Lesson 3 covers what happens once one of these detections actually fires — how an alert becomes an incident, and how an analyst triages it.