Definition
EDR is the endpoint security approach that goes beyond classic antivirus. Antivirus recognises known malicious files by signature; EDR watches behaviour on the computer: which program started what, which files it tried to encrypt, where it connected. When a suspicious chain is seen the device is automatically isolated from the network, an incident timeline is produced and the root cause becomes visible. Even never-seen ransomware is caught by its behaviour. It is managed from a central console; alerts must reach a human, otherwise the console is just a full screen. Separate policies are defined for servers, laptops and desktops.
How SMB Teknoloji uses it
We deploy business antivirus and EDR in one console, separate policies by device type, take on critical alerts for contract customers and deliver a monthly report; the product choice is vendor-neutral.