Endpoint detection and response watches host activity over time and supports investigation and containment on that device.
It is a host focused cycle of telemetry, question, and action, not the preventive suite that mainly blocks known unwanted programs.
How it works
The record may include processes, connections, and changes so an analyst can ask what a device did before an alert.
Containment on that host might isolate it from the network or stop a process, while the wider organization still handles communication and recovery.
Value depends on someone who can interpret the record and on a scope that respects privacy.
Collecting everything forever without a question to answer creates cost and risk, not safety.
Concrete examples
- An analyst traces a suspicious process on a laptop back to a document opened that morning and isolates the laptop.
- A server shows a new scheduled task that no change record explains, and the team contains the host before the task runs again.
- A privacy review limits retention of host telemetry to the period needed for investigations.
Protective measures
- Assign analysts who can investigate host telemetry, not only a tool that stores it.
- Define containment actions that may be taken on a device and who may approve them after hours.
- Keep telemetry only as long as investigations need, and restrict who can search it.
- Connect host findings to the wider incident cycle so isolation is not the last step you remember to tell anyone about.