EDR

EDR software runs on laptops, servers, and workstations to record activity and detect malicious behavior that traditional antivirus misses. Because most attacks eventually touch an endpoint, it is a critical place to watch. SOC teams use it to investigate what happened on a machine and to isolate or remediate compromised endpoints remotely.