We touched on the EDR (back then: ETDR) use cases in this post in 2013, but we are revisiting them in current research. In our view, EDR use cases can be classified in the following manner:
- Data search and investigations (the “R” in EDR)
- Suspicious activity detection (the “D” in EDR)
- Suspicious activity validation (triage process, that sites between security monitoring and IR; essentially the space between “D” and “R”)
- Data exploration or hunting (proactive hunting for malicious activity, typically a high-maturity security organization use case)
- Malicious activity blocking and containment (the active use case where the EDR is used for mitigation and remediation)
Prevention, naturally, is missing since EDR is not about prevention, but some tools can deliver on the preventative use cases in various ways (to be discussed in the paper).
Blog posts related to our current EDR research:
- EDR Tool Wins – Only For The Enlightened?
- EDR Mud Fight: Kernel or Userland?
- Using EDR For Remediation?
- EDR Research Commencing: Call To Action!
- Where Does EDR End and “NG AV” Begin?
- Reality Check on EDR / ETDR
- My Paper on Endpoint Tools Publishes (2013)
- Endpoint Threat Detection & Response Deployment Architecture
- Essential Processes Around Endpoint Threat Detection & Response Tools
- Named: Endpoint Threat Detection & Response
- Endpoint Visibility Tool Use Cases
- On Endpoint Sensing
- RSA 2013 and Endpoint Agent Re-Emergence
- All posts tagged endpoint
Read Complimentary Relevant Research
Three Critical Factors in Building a Comprehensive Security Awareness Program
Three key elements form the foundation of a successful awareness education program: knowledge of audiences, pervasive and continuous...
View Relevant Webinars
IoT for Midsize Enterprises
IoT innovation can deliver growth and product improvement - two of the top business priorities cited by CEOs of midsize enterprises in...
Comments or opinions expressed on this blog are those of the individual contributors only, and do not necessarily represent the views of Gartner, Inc. or its management. Readers may copy and redistribute blog postings on other blogs, or otherwise for private, non-commercial or journalistic purposes, with attribution to Gartner. This content may not be used for any other purposes in any other formats or media. The content on this blog is provided on an "as-is" basis. Gartner shall not be liable for any damages whatsoever arising out of the content or use of this blog.