Endpoint detection and response (EDR) is security technology that continuously monitors endpoints such as laptops, desktops and servers, detects suspicious behavior, and gives security teams the means to investigate and contain it. It goes beyond traditional antivirus, which mainly blocks known malicious files.

How it works

• Telemetry: an agent on each device, or an agentless connector, records process starts, file changes, network connections and logins.
• Detection: the data is analyzed with signatures, behavior rules and machine learning to spot activity such as credential dumping or ransomware encryption.
• Investigation: analysts can see the chain of events on a host and search across all hosts for the same activity.
• Response: actions include killing a process, isolating a device from the network or removing a file.

EDR is often combined with other endpoint protection features, such as host firewalls and malware scanning, and it is a building block of XDR.

Why it matters for dark web monitoring

When a stealer log names an infected corporate machine, EDR is the tool used to confirm the infection, find how the malware arrived and clean the device. Infostealers often run briefly and delete themselves, so EDR history matters. Dark web findings about a company’s devices are a common trigger for an EDR investigation and for broader endpoint protection reviews.

Sources: NIST NCCoE: Implementing a Zero Trust Architecture, Architecture and Builds, NIST CSRC Glossary: endpoint detection and response