Endpoint Detection and Response (EDR) deploys agents that continuously monitor endpoint devices and forward telemetry (processes, connections, file and registry activity, data transfers) to a central database where it is retained for correlation, threat hunting, and later analysis. That centralized collection for retrospective analysis is EDR's defining characteristic. A HIDS (B) inspects a single host and typically alerts locally rather than aggregating rich telemetry centrally for broad later analysis. Antivirus (A) is signature-based blocking at the endpoint, and SOAR (C) orchestrates and automates response workflows rather than acting as the monitoring/collection data store.
Community Discussion