EDR: The Flight Recorder on Every Laptop

The 30-second explanation

EDR works like a flight recorder paired with an alarm on every laptop: it notes what programs do, raises a flag when behaviour looks wrong, and lets a defender isolate that machine remotely.

How it works

1. 1

   1. Record

   The agent logs process, file and network activity continuously.

2. 2

   2. Detect

   Behavioural rules flag suspicious chains of events as they form.

3. 3

   3. Investigate

   An analyst reviews exactly what happened and when.

4. 4

   4. Contain

   The device is isolated from the network while cleanup happens.

A small agent sits on each device and records what programs start, what they launch, which files they touch, and where they connect. That stream flows into a console where detections watch for suspicious patterns, like an ordinary document suddenly launching a command shell. From there, an analyst can trace the full chain of events and contain a device by isolating it from the network while the investigation continues.

Real-world example

How to spot it

• Odd parent-child processes

  An office application or browser launching a command shell on its own.

• Devices with no agent

  Any unmonitored machine on the network is a blind spot by default.

• Protection disabled

  An agent that's been stopped or tampered with, often deliberately.

• Alerts nobody reviews

  A queue growing faster than analysts can work through it.

What to do

1. 1Make sure every laptop and server carries the agent, and alert whenever one stops reporting in.
2. 2Tune detections and review alerts on a fixed schedule, so they actually lead somewhere.
3. 3Practise isolating a device before you're forced to do it during a real incident.