4.5f endpoint security edr xdr

Endpoint

The device the user actually operates: desktop, laptop, or mobile device.

Defense in depth (endpoint context)

Layered security across all platforms rather than relying on one single protection type.

Network edge

The boundary where the internal network meets the internet, typically protected by a firewall with largely static rules.

Access control (general)

Limiting a device or user's access to data based on parameters like username, group, location, or application used.

Posture assessment

Checking a device against current security standards, trusted certificate, antivirus status, app versions, disk encryption, before or during network access.

Trusted device certificate

A company-issued certificate identifying a device as organizationally trusted, checked during posture assessment.

Persistent agent

Permanently installed software that continuously monitors a device, not just during login; requires ongoing updates.

Dissolvable agent

Runs temporarily during login/connection, performs its check, then removes itself completely; no permanent footprint, but still executes code briefly.

Agentless NAC (Network Access Control)

Integrated directly with Active Directory; only runs during login/logout since there's no local software installed at all, and nothing can be scheduled.

Posture assessment failure response

Non-compliant devices can be quarantined onto their own VLAN with remediation instructions, then reassessed before being allowed full access.

EDR (Endpoint Detection and Response)

Extends beyond signature-based antivirus using behavioral analysis and machine learning; correlates process activity to detect threats and performs root-cause analysis.

EDR automated response

Can automatically isolate, quarantine, and roll back a compromised system to a known-good state without human intervention.

XDR (Extended Detection and Response)

Expands EDR's scope beyond a single endpoint, correlating data across multiple systems and diverse data types (network traffic, multiple devices) simultaneously.

XDR advantages over EDR

Catches detections a single-system view would miss, reduces false positives through broader correlation, and speeds up investigation via automation.

EDR vs XDR

EDR gives deep visibility into one endpoint. XDR is EDR's intelligence extended across multiple endpoints and data sources at once.

User behavior analytics (UBA)

Builds a baseline of normal user activity (devices, traffic patterns, data accessed) to detect abnormal deviations; a key XDR data source.