## Module 24 Review
EDR is your specialized camera for endpoints.
*   It tracks **Behavior** (Process Trees), not just signatures.
*   It allows **Live Response** (Shell access, Isolation).
*   Understanding **Parent-Child relationships** is the #1 skill for EDR analysis.

Next: Intrusion Detection Systems (Network visibility).