Endpoint Protection and Detection · Topic 1 of 5
Endpoint Protection Platforms and Endpoint Detection and Response
Compare endpoint protection platforms and EDR: prevention engines, continuous telemetry, investigation, response actions, XDR and managed detection.
- 4 min
- EPP focuses on prevention before and during execution.
- EDR records activity, then detects, investigates and responds.
- Next generation protection adds machine learning and behaviour analysis to signatures.
What it is
An endpoint protection platform (EPP) tries to stop threats on a device, and endpoint detection and response (EDR) finds and handles the ones that get through.
The two ideas are complementary. Prevention is never perfect, so you also need to see what happens on the device and react. Modern products, such as Cisco Secure Endpoint, combine both in one agent.
How it works
EPP works before and during execution, and EDR works across time.
What an EPP does
An EPP is designed to block known and many unknown threats. It uses several layers, because one method is easy to evade.
| Layer | What it does |
|---|---|
| Signature and hash detection | Matches files to known bad patterns or file hashes |
| Reputation lookup | Asks a cloud service for a verdict on a file |
| Machine learning | Judges a file by its features, so it can catch new malware |
| Behaviour monitoring | Watches what a process does, such as encrypting many files |
| Exploit prevention | Blocks the techniques that exploit software flaws |
| Application control | Allows or blocks named applications |
| Host firewall and device control | Limits network use and removable media |
Traditional antivirus relied mostly on signatures. A next generation product adds machine learning and behaviour analysis, so it can stop malware that has no signature yet.
What an EDR does
EDR assumes that some threats will run. It continuously records endpoint activity, such as process starts, file changes, network connections and logins. That data is stored centrally, and analysed.
EDR provides four main functions.
- Detection: rules and analytics spot suspicious patterns in the recorded activity.
- Investigation: an analyst can see the full story, such as which process started which, and what it touched.
- Response: actions on the device, for example isolate it from the network, stop a process or quarantine a file.
- Threat hunting: searching the stored data for signs of an attacker that no alert has found.
Retrospective detection
A file may look clean today and be found malicious tomorrow, when new intelligence arrives. Because EDR keeps a record of where the file went, it can alert you afterwards and show all the affected devices. This is called retrospective detection, and it is a major advantage over prevention alone.
Comparing EPP and EDR
| Aspect | EPP | EDR |
|---|---|---|
| Main goal | Prevent infection | Detect, investigate and respond |
| Timing | Before and during execution | During and after execution |
| Data kept | Little | Rich activity history |
| Typical user | Mostly automatic | Security analyst |
| Example action | Block a file | Isolate a host, trace an attack |
Beyond the endpoint: XDR and MDR
XDR (extended detection and response) widens the view. It collects data from endpoints, email, network, identity and cloud, and correlates it. A single incident can then link a phishing email, a login and a process on a laptop.
MDR (managed detection and response) is a service. The vendor's analysts monitor your environment and respond for you. It suits teams that lack round the clock staff.
Deployment and operations
A lightweight agent, also called a connector, runs on each endpoint. It sends data to a cloud console, where you manage policy, groups and detections. Policy controls how aggressive the product is, for example whether detected files are quarantined or only logged.
Keep the agent up to date and deployed on every device, including servers. Tune exclusions with care, because every exclusion is a place where an attacker can hide.
What good looks like
A mature team prevents most threats automatically, and uses EDR to investigate the rest. Alerts are triaged by severity. Each incident ends with lessons, such as new detections or a block of the infection path.
What to remember for the exam
Six facts cover most questions on this topic.
- EPP focuses on prevention before and during execution.
- EDR records activity, then detects, investigates and responds.
- Next generation protection adds machine learning and behaviour analysis to signatures.
- Retrospective detection finds files that were later judged malicious.
- Typical EDR response actions are host isolation, process termination and file quarantine.
- XDR correlates data from many sources, and MDR is a managed service.
If a question mentions a threat that was found after it entered the network, the answer is EDR or retrospective detection.
Common mistakes
These four mistakes appear often.
Thinking antivirus is enough. Signature only products miss new and fileless threats.
Using EDR without anyone to review alerts. The data is useful only if someone acts on it.
Setting wide exclusions. They create blind spots for attackers to use.
Treating XDR as a single product. It is an approach that connects data from many tools.
Isolating a host cuts it off from the network. Confirm that it is not a critical server before you isolate it.
Check yourself
Work through these three questions.
What is the main difference between EPP and EDR?
EPP aims to prevent infection before and during execution, while EDR records activity to detect, investigate and respond to threats.
What is retrospective detection?
It is an alert raised after a file that looked clean is later judged malicious, with a view of every device that received it.
How does XDR differ from EDR?
XDR correlates data from several sources such as email, network and cloud, and EDR focuses on the endpoint.
Topic 1 of 5 in Endpoint Protection and Detection
Test yourself on Endpoint Protection and Detection
The full Cisco CCNP 350-701 SCOR question bank has 822 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.