## Endpoint Detection and Response (EDR)

**EDR** is the flight recorder for endpoints (laptops, servers, workstations). While a SIEM looks at the "network" and "logs," an EDR looks at **execution** and **behavior**.

### The Old World: Antivirus (EPP)
Traditional Antivirus (AV), or Endpoint Protection Platforms (EPP), relied on **Signatures**.
*   **The Method**: Compare a file's hash (SHA256) against a database of known bad files.
*   **The Flaw**: If an attacker changes *one bit* of the file, the hash changes, and the AV misses it.
*   **The Blind Spot**: AV cannot see "Fileless Malware" (e.g., PowerShell running a malicious script in memory). The file `powershell.exe` is legitimate, so AV ignores it.

### The New World: EDR
EDR assumes that **prevention will fail**. Its goal is **Detection** and **Visibility**.
EDR records *everything* that happens on the device:
1.  **Process Creation**: `cmd.exe` opened `powershell.exe`.
2.  **Network Connections**: `powershell.exe` connected to `1.2.3.4`.
3.  **File Modification**: `powershell.exe` wrote a file to `Temp`.
4.  **Registry Changes**: `powershell.exe` added a generic Run key.

Because it records the *behavior*, it can detect attacks even if the malware file is brand new (Zero-Day).

### Key Functions of EDR
1.  **Continuous Monitoring**: Records activity 24/7, storing it either locally or in the cloud.
2.  **Threat Hunting**: Allows analysts to query the database. "Show me every computer that ran this specific PowerShell command."
3.  **Automated Response**: "If Ransomware behavior is detected, kill the process and isolate the machine."
4.  **Remote Shell**: Allows analysts to remotely log in to the machine to investigate (like SSH, but through the EDR cloud).

### Why EDR is Critical for SOC 1
As a Tier 1 Analyst, you will spend 50% of your time in the EDR console.
*   The SIEM tells you **"Something happened."**
*   The EDR tells you **"EXACTLY what happened."**
*   *Example*: SIEM says "Virus Detected on Host A". EDR shows you that the user downloaded `invoice.zip` from Gmail, opened it, which spawned `cmd.exe`, which ran a script.