What is EDR (Endpoint Detection and Response)?

EDR (Endpoint Threat Detection and Response) uses a zero-day architecture and also provides stronger protection than legacy security solutions. It detects malware present on end-user devices, continuously monitors and collects activity data, then analyzes this data to identify threats and automatically responds to remove threats.

Traditional virus protection software would detect malware through the attacker’s signature. However, advanced threats can also use non-malware actions and technologies today. Therefore, we cannot detect cyber threats with legacy applications. EDR enables these threats to be detected. It records queries, behavior, and events and helps identify underlying vulnerabilities and their causes..

What is XDR (Extended Detection and Response)?

XDR has broader features than EDR. It uses the most up-to-date technologies to gather and correlate more threat information, and uses analytics and automation to help detect attacks today and in the future. XDR collects and correlates data from various sources such as system servers, email, cloud, and endpoints.

XDR offers a more advanced, holistic and cross-platform approach to endpoint detection and response. While EDR aggregates and correlates activities across multiple endpoints, XDR technologies extend the scope of detection beyond endpoints and analyze data from endpoints, networks, servers, cloud workloads, SIEM and more. At this point it is combined across multiple tools and attack vectors and provides a single window view. Out-of-the-box integrations across multiple products and platforms, preset detection mechanisms help improve productivity, threat detection, and forensic analysis processes.

XDR platforms, which often come across as cloud platforms, go far beyond the data collection function of a SIEM. XDR platforms have prebuilt integrations to work with servers, endpoints, networks, email and SIEM/SOAR and capture telemetry.

What is EPP (Endpoint Protection Platform)?

The purpose of EPP is to prevent attacks against endpoints from threats such as malware, zero-day vulnerabilities, and fileless attacks. EPP is a security solution designed to detect and block device-level threats included in the system.

EPP products include 4 processes at the endpoints: predict, prevent, detect and respond. EPPs are located at the endpoints, but often have a cloud-based solution that can collect and analyze data and provide easy access to security analysts.

For example: Zero-day malware or other advanced threats can be detected by an EPP, but when the endpoint is hacked, it starts generating unusual activity. EDR can detect this activity and automatically lock the endpoint, helping security analysts investigate further.

What is MDR (Managed Detection and Response)?

MDR (Management Detection and Response) is an outsourced service to organizations that provides threat hunting services and a response after detection of these threats. MDR also includes a human element: Security vendors consist of MDR customers, security researchers and engineers responsible for monitoring networks, analyzing incidents, responding to security incidents. This service manages endpoint security technologies for organizations with EDR.

Because MDR uses a network-based solution, it can analyze all retroactive traffic. MDR can use the threat intelligence of the relevant institution against cyber attacks as a service scope in the whole process.

In this regard, we specifically point out that the feature that brings MDR to the fore is the cyber security experience and knowledge of the person providing this service. The layers of technology used, the experience and expertise of staff determine how effective an MDR provider can truly be.