EDR: The Flight Recorder on Every Laptop

The 30-second explanation

EDR is like a flight recorder plus an alarm on every laptop: it notes what programs do, raises the alarm when behaviour looks wrong, and lets a defender isolate the machine remotely.

How it works

1. 1

   1. Record

   The agent logs process and network activity.

2. 2

   2. Detect

   Behaviour rules flag suspicious chains of events.

3. 3

   3. Investigate

   An analyst reviews what happened and when.

4. 4

   4. Contain

   The device is isolated while cleanup happens.

A small agent on each device records what programs start, what they launch, which files they touch and where they connect. That data goes to a console where detections look for suspicious patterns, like a document launching a command shell. Analysts can then look at the chain of events, and contain a device by isolating it from the network while they investigate.

Real-world example

How to spot it

• Odd parent-child processes

  An office app or browser launching a shell.

• Devices with no agent

  Unmonitored machines are blind spots.

• Protection disabled

  An agent stopped or tampered with.

• Alerts nobody reviews

  A queue that grows faster than it is worked.

What to do

1. 1Make sure every laptop and server has the agent, and alert when one stops reporting.
2. 2Tune detections and review alerts on a schedule, so they lead to action.
3. 3Practise isolating a device before you need to do it in a real incident.