Logs and network traffic show activity around a machine, but the endpoint itself is where an attack actually runs: a malicious file is opened, a process is started, a credential is stolen. Endpoint detection and response tools watch that activity on every laptop and server, so analysts can see what happened on a host and act on it.
You'll start with what EDR is and the problems it was built to solve. Then you'll see how it works and how it differs from traditional antivirus, learn how to triage and investigate an endpoint alert, and finish with CrowdStrike Falcon, a widely used EDR platform in security operations.
Once you're comfortable here, move on to Threat Intelligence & Hunting to learn how analysts use information about attackers to look for them proactively.
An overview of what endpoint detection and response software does, how it detects and responds to threats, and why it has become a core tool for security teams.
How EDR systems monitor endpoints, spot suspicious behaviour, respond to attacks, and how this goes beyond what traditional antivirus can do.
A walkthrough of how an analyst reviews an alert in Microsoft Defender for Endpoint, using the alert story view to work out what happened on the host.
An introduction to EDR through CrowdStrike Falcon, and how it supports SOC monitoring, incident response, threat hunting, and malware analysis.