What is EDR?

An EDR is a new generation antivirus. The acronym for EDR, Endpoint Detection and Response, indicates the main purpose of this technology, to detect and respond to a security threat.

EDR is software that is installed on a computer and monitors all system activity. Unlike a traditional signature-based antivirus, EDR analyses the behaviour of the software running on the system and detects threats, for example detecting unknown malware not classified by other antivirus engines.

It is common for EDR software to collect telemetry, that is, the detail of all disk, memory or system process activity and send it to a server in the cloud. The search among this telemetry of unknown threats is what is called Threat hunting.