Innomerc Choose your depth. Learn at your own pace.
Understand it
Endpoint detection and response helps defenders observe and investigate activity on devices. It can connect processes, files, sign-ins and network activity and may support actions such as isolating a device. Available telemetry and actions depend on the product and configuration.
A process tree shows which program launched another. A document viewer spawning an unexpected interpreter may deserve investigation. It is a clue, not proof: legitimate automation can produce unusual-looking chains too.
Under the hood
An endpoint sensor collects selected events and sends or stores them for analysis. Rules and behavioral models identify patterns for review. The sensor is not a complete recording of every action; collection limits, operating-system support and connectivity affect visibility.
Process lineage, command context, file hashes, destinations and user identity can help reconstruct activity. Correlation needs reliable timing and identifiers. A filename alone is weak evidence because legitimate and malicious files can share names.
Practitioner perspective
Compare observed activity with the host’s role, approved software and change history. Consider sensor health and tampering when evidence is unexpectedly absent. An alert’s severity is not a substitute for assessing the affected asset and likely impact.
Containment has consequences. Isolating a critical server can disrupt business and may change evidence availability. Use an approved response plan, preserve relevant artifacts and document actions. Endpoint response complements identity, network and application controls.
Watch it work
A fictional, simplified model. Select a component to inspect it, or follow the steps in order.
Explore the system
Document viewer
A user opens a fictional document.
Read every step without animation
Process investigation
- Document viewer. A user opens a fictional document. Defender: Confirm delivery source and whether the user expected this document.
- Interpreter starts. A child interpreter process appears. Defender: Inspect parent–child lineage, command context and approved automation.
- New connection. The child contacts a destination not previously seen on this host. Defender: Correlate destination, timing and other hosts; novelty alone is not guilt.
- Analyst decision. The sequence requires a context-driven conclusion. Defender: Preserve evidence and contain according to confidence, impact and the response plan.
A process tree is evidence to interpret, not a verdict.
Attack view
In the fictional path, a document viewer starts an unexpected interpreter that contacts a new destination. The defender view asks what evidence would distinguish authorized automation from misuse.
Defender view
- Keep sensors deployed, healthy and protected from unauthorized changes.
- Investigate process lineage together with identity and network context.
- Test containment and recovery procedures before an emergency.
Common mistakes
- An EDR sensor is not a complete audit record of every event.
- A suspicious process name alone does not establish compromise.
Check your understanding
Active recall: explain this idea in 30 seconds
Endpoint detection and response helps defenders observe and investigate activity on devices. It can connect processes, files, sign-ins and network activity and may support actions such as isolating a device. Available telemetry and actions depend on the product and configuration.
Now give an example and name one limitation. Revisit the explanation if you get stuck.
Primary sources
Original explanations informed by these specifications and official resources. Source versions and lesson review are separate from product updates.
Content reviewed 2026-09-10. Read the editorial policy.