What is the role of endpoint detection and response (EDR) in modern security operations?

• A. EDR focuses on updating antivirus signatures.
• B. EDR focuses on network devices rather than endpoints.
• C. EDR replaces SIEM as the primary security platform.
• D. EDR monitors endpoints for suspicious activity, contains threats via automated responses, and provides forensic data.

Answer: (D)

Endpoint detection and response focuses on giving visibility into and control over the machines people use. It continuously collects telemetry from endpoints—things like process activity, file and registry changes, network connections, and memory behavior—and uses advanced analytics to spot suspicious or malicious activity as it happens.

When something looks risky, automated containment actions kick in to stop the threat from spreading. This can mean isolating the affected device, terminating malicious processes, or quarantining suspicious files. These rapid, automated responses are essential for limiting damage before human responders can intervene.

EDR also provides rich forensic data for investigations: detailed event timelines, process trees, file and memory artifacts, and indicators of compromise. This information supports root-cause analysis, incident response, and proactive threat hunting.

In modern security operations, EDR and SIEM/SOAR work together. EDR supplies deep endpoint visibility and rapid containment capabilities, while SIEM aggregates data from across the environment and helps with correlation and orchestration. EDR goes beyond simply updating antivirus signatures and is not primarily about network devices, nor is it a replacement for SIEM.