Endpoint Detection and Response (OBJ 4.5)

Question 1

End Point Detection and Response (EDR)

Answer 1

Category of security tools that monitor endpoints and network events and record the information in a central database.

This is where -
Analysis , Detection, Investigation Reporting and alerting takes place.

Question 2

File Integrity Monitoring

Answer 2

Used to validate the integrity of the operating system and application software files using a verification method between the current file state and a known, good baseline.

Question 3

EDR - 6 step process

Answer 3

1. Data Collection
2. Data Consolidation
3. Threat Detection
4. Alerts and Threat Response
5. Threat Investigation
6. Remediation