Section 21.205 Endpoint Detection and Response Flashcards
Objective 4.1 Given a scenario, you must be able to apply common security techniques to computing resources. Objective 4.5 Given a scenario, you must be able to modify enterprise capabilities to enhance security.
Endpoint Detection and Response (EDR)
Category of security tools that monitor endpoint and network events and record the information in a central database
■ Continuously monitoring and response to advanced threats
■ Monitors endpoint and network events, providing data for the following:
● Analysis
● Detection
● Investigation
● Reporting
● Alerting
Focuses on incident data for enhancing security monitoring, incident response,
and forensic investigations
How EDR Works
Data Collection
Collects data from endpoints (devices that are physically on the endpoint
of a network)
○ System processes
○ Registry changes
○ Memory usage
○ Network traffic patterns
How EDR Works
Data Consolidation
Sends collected data to a centralised security solution or database
How EDR Works
Threat Detection
Analyses data using techniques like signature-based and behavioral-based detection to identify threats
How EDR Works
Alerts and Threat Response
Takes actions such as creating alerts or performing threat response actions when threats are detected
How EDR Works
Threat Investigation
Provides tools for security teams to investigate threats, including detailed
timelines and forensic data
How EDR Works
Remediation
● Removing malicious files
● Reversing changes
● Restoring systems to their normal state
File Integrity Monitoring (FIM)
Validates the integrity of operating system and application software files by comparing their current state with a known, good baseline
Identifies changes to:
● Binary files
● System and Application Files
● Configuration and Parameter Files
Monitors critical system files for changes using agents and hash digests, triggering alerts when unauthorised changes occur
Extended Detection and Response (XDR)
Security strategy that integrates multiple protection technologies into a single platform
■ Improves detection accuracy and simplified incident response
■ Correlates data across multiple security layers to detect threats faster, including:
● email
● endpoint
● server
● cloud workloads
● network
Difference between EDR and XDR
EDR is focused on the endpoints to detect and respond to potential threats
XDR is more comprehensive solution because it focuses on endpoints, but also on networks, cloud, and email to detect and respond to potential threats
● It integrates multiple protection technologies
