What signals does the EDR contribute to detection?
The EDR records what happens inside every device that runs its agent. It is the most detailed source for reconstructing an attack on the endpoint and the one that lets you act within seconds. The most used signals:
- Process tree: which process launched which, with what command line and user. This is what gives away a Word document that opens PowerShell.
- Files and registry: executables in temporary paths, autorun entries, and new scheduled tasks and services (persistence).
- Network connections per process, useful for detecting command-and-control communications.
- Credential access: attempts to read LSASS memory or dump password hashes.
- Vendor detections, with severity and the MITRE ATT&CK technique when the tool reports it.
- Agent health: devices with no agent, an outdated agent or protection turned off. Someone switching off the EDR is also a sign of attack.
What does the EDR miss, and why does it need correlation?
The EDR only sees the devices where it is installed. Firewalls, VPNs, routers, printers and industrial systems usually can't run an agent. Mandiant's M-Trends 2026 report describes espionage groups that deliberately target network devices, such as VPNs and routers, which typically lack EDR telemetry. The same report puts the global median attacker dwell time at 14 days, up from 11 the previous year.
Nor does it see what happens outside the device, such as a Microsoft 365 sign-in with stolen credentials. A suspicious execution on a laptop reads differently if, ten minutes earlier, that user signed in from a country where they have no activity, and you only know that by cross-referencing the EDR with identity.
What response actions does an EDR offer?
Almost every EDR offers similar response actions. The names vary between vendors and some depend on the license: according to Microsoft's documentation, Defender for Endpoint Plan 1 only includes some manual actions, such as isolation, while Plan 2 includes the full set.
| Action | What it's for | How it usually appears | Keep in mind |
|---|---|---|---|
| Isolate the device | Cut off lateral movement and exfiltration without shutting down the machine, which preserves its memory. | Network containment (CrowdStrike), Isolate device (Microsoft Defender), Disconnect from network (SentinelOne), Isolate endpoint (Cortex XDR). | It stays connected to the EDR console. For critical servers, agree in advance on who authorizes it. |
| Kill a process | Stop encryption in progress, a crypto miner or a remote access tool. | Kill or terminate process, or from live response. | If there is persistence, it will start again. |
| Quarantine or block a hash | Prevent the binary from running on other devices. | Quarantine file, custom indicators or blocklists. | If the attacker recompiles, the hash changes. |
| Collect evidence | Save processes, connections and logs before remediating. | Investigation package, live response or real time response. | Do it before rebooting or reinstalling. |
| Roll back changes | Undo encryption or modifications in some scenarios. | Rollback in SentinelOne (Windows) or automatic remediation, depending on the product. | It is no substitute for backups. |
What does an EDR need to be operated around the clock?
The EDR detects and lets you act, but someone has to look at the alert at three in the morning, decide whether it's real and contain it. Whether that work falls to an in-house SOC, a traditional MDR or an agentic SOC, it should cover:
- 24/7 triage: dismissing false positives and escalating what matters, with context.
- Correlation with identity, email, network and cloud, which the EDR doesn't see on its own.
- Agreed containment: which actions are taken without calling you and which need your approval.
- Proactive threat hunting in historical telemetry, even for threats that never triggered an alert.
- Review of overly broad exclusions and policies left in detect-only mode.
All of this can run on top of the EDR you already have. If a provider requires you to switch, weigh the cost of migrating and what happens to your history.
How does it differ from integrating other sources?
The EDR is the integration with the most direct response, because it acts on the device where the attacker is. Identity and email act on accounts and mailboxes, the network acts on traffic, and the SIEM brings history but usually doesn't execute actions. An investigation uses all of them: the EDR explains what happened on the device, and the others explain how the attacker got in and where they tried to go.
What should you check in your EDR?
- Coverage: compare your inventory with the devices reporting to the EDR. The missing ones are blind spots.
- Policy mode: many deployments are still in detect-only mode months after rollout.
- Which devices are isolated without asking (laptops) and which require approval (production servers, plant floor systems).
- Retention: whether the history is long enough to investigate an attack that started weeks earlier.
How Ciberia helps
Ciberia MDR connects to your EDR or XDR and does not replace it. Its alerts are correlated with the other integrated sources and enriched with intelligence from Ciberia Intel. The flow is Alert, Context, Decision and Action: proprietary AI agents investigate every alert, automate around 90% of triage and propose the response, and an analyst validates decisions with impact before the action is orchestrated in your EDR according to the tool, such as isolating the device or killing the process. For critical alerts, the contractual SLA is 15 minutes to initial containment, with 24/7 coverage and every action logged.
