Also known as: Endpoint Detection and Response · XDR
EDR (Endpoint Detection and Response) is security software installed on endpoints that continuously records process, file, and network activity, detects suspicious behaviour, and enables remote investigation and containment.
EDR differs from traditional antivirus by focusing on behaviour rather than signatures, and by retaining a queryable history of endpoint activity. That history is often the single most valuable artifact during an investigation, allowing responders to reconstruct exactly what happened.
The remote containment capability — isolating a host from the network while retaining investigator access — is frequently the deciding factor in limiting an incident. XDR extends the same model beyond endpoints to identity, email, and cloud telemetry.
SIEM
A SIEM (Security Information and Event Management) system centralises log and event data from across an organisation's infrastructure, correlating it to detect suspicious activity and support investigation.
Security Operations Center
A security operations center (SOC) is the team and function responsible for continuously monitoring an organisation's environment for security threats, triaging alerts, and initiating incident response.
Incident Response
Incident response is the structured process an organisation follows to detect, contain, eradicate, and recover from a security incident, and to learn from it afterwards.
Threat Hunting
Threat hunting is the proactive search for attackers already present in an environment, driven by hypotheses about adversary behaviour rather than by alerts from automated detection tools.
Ransomware
Ransomware is malicious software that denies an organisation access to its own data — historically by encrypting it — and demands payment in exchange for restoring access or withholding publication of stolen data.