EDR
Endpoint Detection and Response — security software on computers and servers (endpoints) that continuously monitors behavior, detects suspicious activity, and lets a team investigate and respond (e.g. isolate an infected machine). The successor to traditional antivirus.
The difference from classic AV: antivirus looks for known malicious FILES (signatures); EDR looks at BEHAVIOR — what processes do, how they communicate, what system calls they make — and therefore catches modern threats like fileless malware and living-off-the-land that AV misses. Features: detailed telemetry/recording of endpoint activity (to be able to trace an intrusion after the fact), automatic detection of suspicious patterns, and response capabilities (isolate the machine from the network, kill processes, gather forensics). Examples: CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne. Often built on eBPF/kernel-near monitoring. Extended into XDR (correlate across more sources) and fed into SOAR/SIEM. The core component of modern endpoint security. Related to XDR and fileless malware.