Many EDR security vendors offer threat intelligence subscriptions as part of their endpoint security solution.Īdditionally, new investigative capabilities in some EDR solutions can leverage AI and machine learning to automate the steps in an investigative process.

That collective intelligence helps increase an EDR's ability to identify exploits, especially multi-layered and zero-day attacks. Threat intelligence services provide an organization with a global pool of information on current threats and their characteristics. New features and services are expanding EDR solutions' ability to detect and investigate threats.įor example, third-party threat intelligence services, such as Trellix Global Threat Intelligence, increase the effectiveness of endpoint security solutions. New EDR capabilities improve threat intelligence IT security professionals also use forensics tools to hunt for threats in the system, such as malware or other exploits that might lurk undetected on an endpoint. Forensics tools enable IT security professionals to investigate past breaches to better understand how an exploit works and how it penetrated security.

A real-time analytics engine uses algorithms to evaluate and correlate large volumes of data, searching for patterns.

An endpoint detection and response system may incorporate both real-time analytics, for rapid diagnosis of threats that do not quite fit the pre-configured rules, and forensics tools for threat hunting or conducting a post-mortem analysis of an attack. Pre-configured rules in an EDR solution can recognize when incoming data indicates a known type of security breach and triggers an automatic response, such as to log off the end user or send an alert to a staff member.Īnalysis and forensics.

Software agents conduct endpoint monitoring and collect data-such as processes, connections, volume of activity, and data transfers-into a central database.Īutomated response. EDR tools have three basic components:Įndpoint data collection agents. EDR security provides an integrated hub for the collection, correlation, and analysis of endpoint data, as well as for coordinating alerts and responses to immediate threats.

Alyak english