Endpoint detection and response: Difference between revisions
Eveninglatte (talk | contribs) Added a mention of the OpenEDR initiative |
Added info Tags: Mobile edit Mobile web edit Advanced mobile edit |
||
| Line 1: | Line 1: | ||
{{short description|Threat monitoring technology}} |
{{short description|Threat monitoring technology}} |
||
'''Endpoint detection and response''' ('''EDR'''), also known as '''endpoint threat detection and response''' ('''ETDR'''), is a [[cybersecurity]] technology that continually monitors an "endpoint" (e.g. [[mobile phone]], [[laptop]], [[Internet of things]] device) to mitigate malicious cyber threats.<ref name=":1" /><ref>{{Cite web|url=https://www.techopedia.com/definition/33710/endpoint-detection-and-response-edr|title=What is Endpoint Detection and Response (EDR)? - Definition from Techopedia|website=Techopedia.com|language=en|access-date=2019-09-29}}</ref><ref>{{Cite web|url=https://www.paloaltonetworks.com/cyberpedia/what-is-endpoint-detection-and-response-edr|title=Endpoint Detection and Response (EDR) - What is EDR and why is it important? - Definition from Cyberpedia|website=Palo Alto Networks|language=en|access-date=2021-09-03}}</ref> |
'''Endpoint detection and response''' ('''EDR'''), also known as '''endpoint threat detection and response''' ('''ETDR'''), is a [[cybersecurity]] technology that continually monitors an "endpoint" (e.g. [[mobile phone]], [[laptop]], [[Internet of things]] device) to mitigate malicious cyber threats.<ref name=":1" /><ref>{{Cite web|url=https://www.techopedia.com/definition/33710/endpoint-detection-and-response-edr|title=What is Endpoint Detection and Response (EDR)? - Definition from Techopedia|website=Techopedia.com|language=en|access-date=2019-09-29}}</ref><ref>{{Cite web|url=https://www.paloaltonetworks.com/cyberpedia/what-is-endpoint-detection-and-response-edr|title=Endpoint Detection and Response (EDR) - What is EDR and why is it important? - Definition from Cyberpedia|website=Palo Alto Networks|language=en|access-date=2021-09-03}}</ref> |
||
== History == |
== History == |
||
Latest revision as of 23:29, 13 October 2024
Endpoint detection and response (EDR), also known as endpoint threat detection and response (ETDR), is a cybersecurity technology that continually monitors an "endpoint" (e.g. a client device such as a mobile phone, laptop, Internet of things device) to mitigate malicious cyber threats.[1][2][3]
History
[edit]In 2013, Anton Chuvakin of Gartner coined the term "endpoint threat detection and response" for "tools primarily focused on detecting and investigating suspicious activities (and traces of such) other problems on hosts/endpoints".[4] Now, it is commonly known as "endpoint detection and response".
According to the Endpoint Detection and Response - Global Market Outlook (2017-2026) report, the adoption of cloud-based and on-premises EDR solutions are going to grow 26% annually, and will be valued at $7273.26 million by 2026.[5] According to the Artificial Intelligence (AI) in Cyber Security Market report by Zion Market Research, the role of machine learning and artificial intelligence will create a $30.9 billion cyber security market by 2025.[6][7]
Concept
[edit]Endpoint detection and response technology is used to identify suspicious behavior and advanced persistent threats on endpoints in an environment, and alert administrators accordingly. It does this by collecting and aggregating data from endpoints and other sources. That data may or may not be enriched by additional cloud analysis. EDR solutions are primarily an alerting tool rather than a protection layer but functions may be combined depending on the vendor. The data may be stored in a centralized database or forwarded to a SIEM tool for cyber monitoring.[8][9]
Every EDR platform has its unique set of capabilities. However, some common capabilities include the monitoring of endpoints in both the online and offline mode, responding to threats in real-time, increasing visibility and transparency of user data, detecting stored endpoint events and malware injections, creating blocklists and allowlists, and integration with other technologies.[1][8] Some vendors of EDR technologies leverage the free MITRE ATT&CK classification and framework for threats.[10]
See also
[edit]References
[edit]- ^ a b "EDR Security and Protection for the Enterprise". Cynet. Retrieved 2019-09-29.
- ^ "What is Endpoint Detection and Response (EDR)? - Definition from Techopedia". Techopedia.com. Retrieved 2019-09-29.
- ^ "Endpoint Detection and Response (EDR) - What is EDR and why is it important? - Definition from Cyberpedia". Palo Alto Networks. Retrieved 2021-09-03.
- ^ Chuvakin, Anton (2013-07-26). "Named: Endpoint Threat Detection & Response". Gartner Blog Network. Retrieved 2019-09-16.
- ^ "Global $7.27 Bn Endpoint Detection and Response Market to 2026". finance.yahoo.com. Retrieved 2019-09-24.
- ^ Research, Zion Market (2019-08-28). "Artificial Intelligence (AI) In Cyber Security Market Will Reach to USD 30.9 Billion By 2025: Zion Market Research". GlobeNewswire News Room. Retrieved 2019-10-10.
- ^ "10 Ways AI And Machine Learning Are Improving Endpoint Security". Business 2 Community. Retrieved 2019-10-10.
- ^ a b "What is endpoint detection and response (EDR)? A definition by WhatIs.com". SearchSecurity. Retrieved 2019-09-29.
- ^ "What Is EDR? | A Brief Definition of Endpoint Detection and Response". Comodo News For Enterprise Security. 2019-03-06. Retrieved 2019-09-29.
- ^ "Symantec Endpoint Detection & response Data Sheet". Broadcom.