Endpoint Detection and Response (EDR) is a class of security tooling that continuously watches activity on laptops, servers, and other endpoints, recording process launches, file changes, network connections, and registry edits. When something looks like an attack, EDR alerts analysts and hands them the telemetry needed to investigate, contain, and roll back.
The shift from traditional antivirus matters here. Signature-based antivirus asks whether a file matches known malware; EDR asks whether behavior looks malicious, which catches novel or customized threats that have no signature yet. The tradeoff is real, though. EDR generates a flood of data and alerts, so without careful tuning and skilled responders on hand, teams drown in noise and miss the handful of events that actually count. Many organizations pair it with a managed detection and response service for exactly that reason.
How is EDR tested on the CISSP?
EDR supports monitoring and incident response in Domain 7: Security Operations. You should understand how endpoint telemetry feeds a SIEM, how behavioral detection differs from signature matching, and how EDR data supports both rapid containment and later forensic analysis of an incident.