{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://atlas.maintz.dev/)"},"id":"security/edr","url":{"en":"https://atlas.maintz.dev/en/terms/security/edr/","da":"https://atlas.maintz.dev/da/terms/security/edr/"},"term":{"en":"Endpoint detection and response (EDR)","da":"Endpoint detection and response (EDR)"},"aka":{"en":["EDR"],"da":["EDR"]},"domain":["security"],"cluster":"controls","layer":"host","status":"current","era":2013,"summary":{"en":"Software on each computer and phone that watches for signs of an attack and can stop it on the spot.","da":"Software på hver computer og telefon, der holder øje med tegn på angreb og kan stoppe dem på stedet."},"body":{"formal":{"en":"A tool installed on every endpoint that records what programs and users do, flags behaviour that matches known attack patterns, and lets defenders cut the device off, end a process or undo changes from one central screen.","da":"Et værktøj, der installeres på hvert endpoint, registrerer hvad programmer og brugere gør, markerer adfærd, der ligner kendte angrebsmønstre, og lader forsvarerne isolere enheden, stoppe en proces eller rulle ændringer tilbage fra én central skærm."},"plain":{"en":"Like a guard posted inside every room of a building rather than only at the front door - they notice odd behaviour and can lock the room at once.","da":"Som en vagt i hvert eneste rum i bygningen i stedet for kun ved hoveddøren - vagten opdager mærkelig adfærd og kan låse rummet med det samme."},"inPractice":{"en":"A laptop in a pension fund's customer department suddenly starts locking hundreds of files; the EDR tool spots the pattern, stops the process and cuts the laptop off the network before the IT operations manager has even seen the alarm.","da":"En bærbar i en pensionskasses kundeafdeling begynder pludselig at låse hundredvis af filer; EDR-værktøjet genkender mønstret, stopper processen og isolerer maskinen fra netværket, før den IT-driftsansvarlige overhovedet har set alarmen."},"whyItMatters":{"en":"Attackers who slip past the outer defences still have to act on some device, so watching every device closely is often the last real chance to catch them early.","da":"Angribere, der slipper forbi de ydre forsvar, skal stadig handle på en enhed, så tæt overvågning af hver enhed er ofte den sidste reelle chance for at fange dem tidligt."}},"deepDive":{"en":"The category was named in 2013 by Gartner analyst Anton Chuvakin as \"endpoint threat detection and response\", later shortened to EDR. Its defining shift from classic antivirus (now usually called EPP, endpoint protection platform) is continuous telemetry recording rather than file scanning alone. On Windows an EDR sensor typically combines a kernel-mode driver registering process, thread, image-load and registry callbacks (PsSetCreateProcessNotifyRoutineEx and related APIs), a file-system minifilter, network filtering, Event Tracing for Windows providers including the Microsoft-Windows-Threat-Intelligence provider, and the Antimalware Scan Interface (AMSI) for script content. On macOS and Linux the equivalents are Apple's Endpoint Security framework and eBPF or audit subsystems respectively.\n\nTelemetry - process trees with command lines, parent/child relationships, network connections, file and registry writes, module loads - is streamed to a cloud or on-premises backend. Detection combines local machine-learning classifiers, behavioural rules (for example Office spawning a PowerShell process that downloads and executes content), indicators of compromise and analytics mapped to MITRE ATT&CK techniques. Response actions include network containment (the host can reach only the EDR backend), process kill, file quarantine, remote shell for live forensics and, on some platforms, rollback of changes. Retained telemetry enables threat hunting and retrospective queries when a new indicator is published.\n\nEDR has well-known limits. Attackers disable or blind sensors through \"bring your own vulnerable driver\" (BYOVD) techniques that load a legitimately signed but vulnerable kernel driver to kill protected processes, through unhooking of user-mode hooks, or by operating from assets without a sensor - hypervisors, network appliances, OT and IoT devices, unmanaged machines. Tamper protection and alerting on sensor silence are therefore essential. Kernel presence is also an availability risk: on 19 July 2024 a faulty content update to CrowdStrike Falcon crashed roughly 8.5 million Windows machines, prompting Microsoft to work with vendors on moving security functionality out of the kernel.\n\nNeighbouring terms: XDR extends the same detection-and-response model across email, identity, cloud and network sources; MDR is a managed service in which an external SOC operates the EDR; a SIEM ingests EDR alerts for correlation with other logs but is not a replacement for the sensor. EDR supports CIS Controls v8 Control 10 (Malware Defenses) and ISO/IEC 27002:2022 controls 8.7 (protection against malware) and 8.16 (monitoring activities). An EDR deployment is only as good as its coverage and triage: the metric that matters is the share of endpoints with a healthy sensor and the time from alert to containment.","da":"Kategorien blev navngivet i 2013 af Gartner-analytikeren Anton Chuvakin som \"endpoint threat detection and response\", senere forkortet til EDR. Det, der adskiller den fra klassisk antivirus (i dag ofte kaldt EPP, endpoint protection platform), er kontinuerlig optagelse af telemetri frem for alene at scanne filer. På Windows kombinerer en EDR-sensor typisk en kernel-driver, der registrerer callbacks for processer, tråde, indlæsning af moduler og registreringsdatabasen (PsSetCreateProcessNotifyRoutineEx og beslægtede API'er), en minifilter i filsystemet, netværksfiltrering, Event Tracing for Windows-udbydere, herunder Microsoft-Windows-Threat-Intelligence, og Antimalware Scan Interface (AMSI) til scriptindhold. På macOS og Linux er de tilsvarende mekanismer Apples Endpoint Security-framework og henholdsvis eBPF eller audit-undersystemer.\n\nTelemetrien - procestræer med kommandolinjer, forældre-/barnrelationer, netværksforbindelser, skrivninger til filer og registreringsdatabase, indlæste moduler - streames til en backend i cloud eller on-premises. Detektionen kombinerer lokale machine learning-klassifikatorer, adfærdsregler (fx at Office starter en PowerShell-proces, der henter og kører indhold), kompromitteringsindikatorer og analyser kortlagt til MITRE ATT&CK-teknikker. Responshandlinger omfatter netværksisolering (maskinen kan kun tale med EDR-backenden), afslutning af processer, karantæne af filer, fjern-shell til live-forensics og på nogle platforme tilbagerulning af ændringer. Gemt telemetri muliggør threat hunting og tilbagevirkende søgninger, når en ny indikator offentliggøres.\n\nEDR har velkendte begrænsninger. Angribere deaktiverer eller blænder sensorer med \"bring your own vulnerable driver\" (BYOVD), hvor en legitimt signeret, men sårbar kernel-driver indlæses for at dræbe beskyttede processer, ved at fjerne hooks i user mode eller ved at operere fra aktiver uden sensor - hypervisorer, netværksudstyr, OT- og IoT-enheder og uadministrerede maskiner. Manipulationsbeskyttelse (tamper protection) og alarmer, når en sensor går tavs, er derfor afgørende. Tilstedeværelsen i kernen er også en tilgængelighedsrisiko: den 19. juli 2024 fik en fejlbehæftet indholdsopdatering til CrowdStrike Falcon omkring 8,5 millioner Windows-maskiner til at gå ned, hvilket fik Microsoft til at arbejde med leverandørerne om at flytte sikkerhedsfunktionalitet ud af kernen.\n\nNabobegreber: XDR udvider samme detektions- og responsmodel til mail, identitet, cloud og netværk; MDR er en managed service, hvor en ekstern SOC driver EDR'en; en SIEM modtager EDR-alarmer til korrelation med andre logs, men erstatter ikke sensoren. EDR understøtter CIS Controls v8 Control 10 (Malware Defenses) og ISO/IEC 27002:2022 kontrol 8.7 (beskyttelse mod malware) og 8.16 (overvågningsaktiviteter). En EDR-udrulning er aldrig bedre end dens dækning og triage: de tal, der tæller, er andelen af endpoints med en sund sensor og tiden fra alarm til isolering."},"howTo":{"steps":{"en":["Start from the asset inventory, count endpoints and servers per operating system, and list the devices that cannot run a sensor, such as network appliances, hypervisors and OT equipment, so they get other monitoring.","Decide who watches and acts on EDR alerts around the clock - your own SOC or an MDR provider - and which response actions, such as isolating a host, may be taken without asking first.","Roll the sensor out in waves, starting with a pilot group and then servers and admin workstations, and check performance and conflicts with other security software before going wide.","Turn on tamper protection, so users and attackers cannot stop or uninstall the sensor, and limit who can change EDR policies.","Set the policies from audit mode to blocking once you have tuned the exclusions, keeping exclusions few and documented.","Send EDR alerts and key telemetry to the SIEM, and keep the telemetry long enough for investigations and threat hunting.","Alert when a sensor goes silent or unhealthy, and report every month the share of endpoints with a working sensor and the time from alert to containment.","Rehearse the response actions - isolating a host, killing a process, collecting forensic data - and plan how you roll back a faulty sensor or content update."],"da":["Tag udgangspunkt i aktivfortegnelsen, tæl endpoints og servere pr. styresystem, og list de enheder, der ikke kan køre en sensor, fx netværksudstyr, hypervisorer og OT-udstyr, så de får anden overvågning.","Beslut, hvem der holder øje med og reagerer på EDR-alarmer døgnet rundt - jeres egen SOC eller en MDR-leverandør - og hvilke responshandlinger, fx at isolere en maskine, der må udføres uden at spørge først.","Rul sensoren ud i bølger, begyndende med en pilotgruppe og derefter servere og administratorarbejdsstationer, og tjek ydelse og konflikter med anden sikkerhedssoftware, før I går bredt ud.","Slå manipulationsbeskyttelse (tamper protection) til, så brugere og angribere ikke kan stoppe eller afinstallere sensoren, og begræns, hvem der kan ændre EDR-politikkerne.","Skift politikkerne fra overvågningstilstand til blokering, når undtagelserne er tunet, og hold undtagelserne få og dokumenterede.","Send EDR-alarmer og vigtig telemetri til SIEM'en, og gem telemetrien længe nok til undersøgelser og threat hunting.","Slå alarm, når en sensor går tavs eller er usund, og rapportér hver måned andelen af endpoints med en fungerende sensor og tiden fra alarm til isolering.","Øv responshandlingerne - isolering af en maskine, stop af en proces, indsamling af forensiske data - og planlæg, hvordan I ruller en fejlbehæftet sensor- eller indholdsopdatering tilbage."]},"pitfalls":{"en":["Counting licences instead of healthy sensors, so machines without a working agent go unnoticed.","Buying EDR without anyone to act on its alerts at night and at weekends, so an alarm can sit unread until the damage is done.","Adding broad exclusions for folders or tools to stop false positives, which gives attackers a place to hide.","Forgetting the devices without a sensor, which attackers use precisely because nobody is watching them."],"da":["At tælle licenser i stedet for sunde sensorer, så maskiner uden en fungerende agent går under radaren.","At købe EDR uden nogen til at reagere på alarmerne om natten og i weekenden, så en alarm kan ligge ulæst, til skaden er sket.","At lave brede undtagelser for mapper eller værktøjer for at slippe for falske positiver, hvilket giver angribere et sted at gemme sig.","At glemme enhederne uden sensor, som angribere netop bruger, fordi ingen holder øje med dem."]},"guides":[{"title":"CIS Critical Security Control 10 - Malware Defenses","url":"https://www.cisecurity.org/controls/malware-defenses","publisher":"Center for Internet Security","tier":"standard"},{"title":"NIST SP 800-83 Rev. 1 - Guide to Malware Incident Prevention and Handling for Desktops and Laptops","url":"https://csrc.nist.gov/pubs/sp/800/83/r1/final","publisher":"NIST","tier":"standard"},{"title":"Get started with your Microsoft Defender for Endpoint deployment","url":"https://learn.microsoft.com/en-us/defender-endpoint/mde-planning-guide","publisher":"Microsoft","tier":"official-doc"}]},"edges":[{"type":"requires","to":"security/endpoint","confidence":"high","strength":"normal"},{"type":"kind-of","to":"security/control","confidence":"high","strength":"normal"},{"type":"mitigates","to":"security/malware","why":{"en":"It recognises harmful programs by what they do, not only by what they look like, and stops them.","da":"Det genkender skadelige programmer på, hvad de gør, ikke kun på hvordan de ser ud, og stopper dem."},"confidence":"high","strength":"primary"},{"type":"mitigates","to":"security/ransomware","why":{"en":"Mass locking of files is a clear pattern it can spot and halt within seconds.","da":"Når mange filer låses på én gang, er det et tydeligt mønster, som det kan opdage og standse på sekunder."},"confidence":"high","strength":"normal"},{"type":"used-with","to":"security/siem","why":{"en":"Its alarms are sent to the SIEM so they can be seen next to events from the rest of the organisation.","da":"Dets alarmer sendes til SIEM'en, så de kan ses sammen med hændelser fra resten af organisationen."},"confidence":"high","strength":"normal"},{"type":"used-with","to":"security/soc","confidence":"high","strength":"normal"}],"depth":2,"sources":[{"title":"CIS Controls v8 - Control 10 (Malware Defenses) and Control 13 (Network Monitoring and Defense)","tier":"standard","publisher":"Center for Internet Security"},{"title":"NIST SP 800-83 Rev. 1 - Guide to Malware Incident Prevention and Handling","tier":"standard","publisher":"NIST"}],"draft":true}