Endpoint detection and response
Endpoint detection and response (EDR) collects and analyzes activity on devices to help security teams detect threats, investigate what happened, and take response actions.
Following what happened on a device
EDR helps an analyst connect activity such as a process starting, a file changing, and a network connection being made. That context supports investigation beyond the initial alert: what ran, what else it touched, and which device needs attention.
EDR and antivirus can be part of the same product, but the terms describe different work. Antivirus focuses on detecting and preventing malicious software. EDR adds an investigation and response workflow around device activity. Modern antivirus also uses behavioral detection, so “antivirus uses signatures; EDR uses behavior” is too simplistic.
An alert is not containment
Response capabilities may include collecting investigation data, quarantining a file, or isolating a device. Available actions depend on the product, platform, licensing, and configuration. Some require an analyst; others can be automated.
Microsoft’s documentation also makes a useful limitation explicit: Defender for Endpoint is not intended to record every operation on a device. Do not assume that an empty search proves nothing happened, or that every alert means a response action succeeded.
The human request can matter as much as the detection. An antivirus exclusion request asks someone to change protection; a Full Disk Access request asks them to grant a powerful permission. EDR may provide relevant device evidence, while the team still needs to verify why the change was requested.