Endpoint Detection and Response: Not Just Tools, But Capabilities

While Anton Chuvakin coined the term “endpoint detection and response” to classify an emerging set of tools, the term may also be used to describe a much broader set of security capabilities. For instance, a tool may offer endpoint detection and response in addition to application control, data encryption, device control and encryption, privileged user control, or network access control.

Both endpoint detection and response tools and those offering EDR as part of a broader set of capabilities are suitable for a multitude of endpoint visibility use cases. Anton Chuvakin groups these cases within three broader categories of endpoint visibility (which do not account for the “response” portion of EDR):

• Data search and investigations
• Suspicious activity detection
• Data exploration

Most endpoint detection and response tools address the “response” portion through sophisticated analytics that identify patterns and detect anomalies, such as rare processes, strange or unrecognized connections, or other risky activities flagged based on baseline comparisons. This process can be automated so that anomalies trigger alerts for immediate action or further investigation. Many endpoint detection and response tools also allow for manual or user-led analysis of data as well.

The Need for Endpoint Security

Endpoint detection and response is still an emerging field, but EDR capabilities are quickly becoming an essential element of enterprise security solution. Organizations that are looking for the most advanced security system available should pay attention to EDR capabilities when evaluating vendors.

Here are several key EDR features to look for when considering an endpoint security solution:

• Filtering: Lower-quality solutions tend to struggle with filtering out false positives. Alerts are triggered for events that are now threats, creating alert fatigue and increasing the possibility for real threats to slip through unnoticed.
• Advanced Threat Blocking: A good solution will prevent threats the moment they are detected and throughout the life of the attack. Persistent attacks could eventually overcome security measures on products with weaker offerings.
• Incident Response Capabilities: Threat hunting and incident response can help prevent full-blown data breaches. Having a solution that aids security personnel in these efforts is critical for DLP.
• Multiple Threat Protection: Advanced attacks, or perhaps multiple different attacks at once, can overwhelm endpoint unless the installed security solution is prepared to handle multiple types of threats at the same time (i.e. ransomware, malware, suspicious data movements).

For enterprises requiring advanced threat protection, EDR is in high demand. The benefits gained through continuous visibility into all data activity make endpoint detection and response a valuable component of any security stack.