Endpoint Detection and Response

Endpoint detection and response (EDR) provides visibility into activity occurring on the network and endpoints by continuously monitoring activity for behavioural patterns that appear to be suspicious or anomalous. Data captured provides rich contextual information related to a threat to enable more efficient, prioritised remediation. EDR technologies not only collect data, but use preconfigured detection models to enable teams to proactively hunt for threats before they can impact the organisation.

Why is it important (hot)?

Endpoint protection (EPP) technologies have traditionally been focused on preventing malware from infecting endpoints, which are proliferating rapidly in number and which are now used by adversaries as a preferred threat vector. They were focused on preventing infection, rather than on detecting threats that have gained a foothold on the network and removing them. EDR technologies enable organisations to move from a reactive to a proactive security stance that enables detection of even advanced, previously unseen threats, providing context regarding how the threat has impacted the network so that remediation can be prioritised to focus on the most critical events.

How does it work?

One of the core features of EDR technologies is that they monitor endpoint and network events, looking for suspicious or anomalous behaviour from both internal and external sources that does not conform to normal patterns of behaviour from devices or users. Data pertaining to events uncovered is stored in a central database so that it can be analysed to provide insight that can drive more efficient and automated incident response. By taking into account context surrounding events associated with device and user behaviour, the scourge of false positives can be greatly reduced so that remediation action can be taken in a more efficient manner.

Threat intelligence is key to EDR, helping 81% of organisations to improve their prevention, detection and response capabilities, according to the SANS Institute. Threat intelligence can be gathered from within the network and endpoints, as well as from feeds that analyse vast swathes of samples collected in the wild as well as submitted by organisations that have encountered them. In order to effectively make sense of the huge number of intelligence events, machine learning enables the analysis of big data sets to spot hidden patterns such as indicators of compromise that could indicate a threat, even where no alert has been raised. Threat and malware variants uncovered are stored in a knowledge base to enable automated remediation when the same or a similar threat is detected again. The value of machine learning increases over time as the knowledge base grows. When combined with behavioural analysis, organisations can even uncover events that evade machine learning capabilities.

The use of threat intelligence and automated detection is key to threat hunting enablement, whereby security analysts proactively search for advanced threats that evade existing security solutions, helping to reduce exposure to and improving the accuracy of response to threats in order to reduce the likelihood of security breaches.