EDR and XDR: endpoint detection, response and host isolation
In short: EDR agents record detailed activity on each endpoint, detect suspicious behaviour and let analysts respond remotely, for example by isolating a host. XDR joins endpoint data with email, identity, network and cloud signals so related alerts become one incident.
From antivirus to EDR
Traditional antivirus compares files against known signatures and blocks matches. That works for known malware but misses attackers who use legitimate tools such as PowerShell, remote desktop or built-in system utilities, often called living off the land. Endpoint Detection and Response (EDR) adds continuous recording and behavioural detection. Instead of asking only "is this file bad?", it asks "is this sequence of actions suspicious?".
Most modern products combine next-generation antivirus with EDR in one agent. Well-known examples include Microsoft Defender for Endpoint, CrowdStrike Falcon and SentinelOne; open-source options such as Wazuh and osquery cover some of the same ground.
What EDR records and why it helps
The most useful view in any EDR console is the process tree. Suppose a user opens a spreadsheet, the spreadsheet starts cmd.exe, which starts PowerShell with an encoded command, which then connects to an unknown domain. Each step alone could be innocent. The chain from an office application to a script interpreter to the internet is a classic sign of a malicious document.
Because the agent keeps a history, analysts can look back: when did this file first appear, which other hosts ran the same hash, and what did the process do next? This turns a single alert into a timeline.
Responding from the console
| Action | What it does | When to use it |
|---|---|---|
| Isolate host | Cuts network access except to the EDR console | Active compromise or ransomware spreading |
| Kill process | Stops a running process tree | Malicious process confirmed |
| Quarantine file | Moves the file to a safe location | Malware on disk |
| Block hash or indicator | Prevents it running on any managed host | Stop spread to other machines |
| Live response | Remote shell to collect files or memory | Deeper investigation |
Isolation is powerful because the analyst keeps remote access while the attacker loses it. Before isolating a critical server, agree with its owner, because isolation also stops the service. Your incident response plan should say who can approve this.
XDR and practical advice
Extended Detection and Response (XDR) joins endpoint data with email, identity, network and cloud telemetry. A phishing email, a risky sign-in and a suspicious process on the same user's laptop become one incident rather than three separate alerts. XDR overlaps with a SIEM; many organisations use both, with the SIEM holding wider and longer log history.
- Aim for full coverage: an unmanaged laptop or server is a blind spot. Compare EDR inventory with your asset list regularly.
- Protect the agent: enable tamper protection so attackers cannot simply uninstall it.
- Tune exclusions carefully; broad folder exclusions are a favourite hiding place.
- Practise isolation and release in a test group before you need it in an emergency.
Real-world example: isolating an infected reception PC
At a fictional dental practice group, the EDR agent on a reception PC flags a document that launched a script, which then tried to download a file and change startup settings. The managed IT provider sees the alert within minutes and uses the EDR console to isolate the PC from the network, while keeping its link to the console open. They collect the process tree, confirm that the document arrived by email, and search every other endpoint for the same file hash; two other inboxes had received it but nobody opened it. The PC is reimaged, the email is purged from all mailboxes and the receptionist's password is reset as a precaution. Patient booking moves to a spare PC for the afternoon, so the practice keeps running.
Practice
Why can EDR catch attacks that signature antivirus misses?
What does host isolation still allow?
How does XDR differ from EDR?
Key takeaways
- EDR records process, file, network and registry activity on each endpoint.
- Process trees reveal suspicious chains such as office app to PowerShell to internet.
- Response actions include isolate, kill, quarantine and block.
- XDR correlates endpoint data with email, identity and cloud signals.
- Coverage gaps, weak tamper protection and broad exclusions undermine EDR.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.