Incident Response · Topic 6 of 6
Enhanced Incident Response with EDR and XDR
Learn how EDR and XDR collect telemetry, detect threats and contain incidents, and how they differ from antivirus, SIEM and SOAR, for the CSA 312-39 exam.
- 5 min
- EDR is behavioral endpoint detection plus remote response; antivirus is mainly signature based.
- XDR correlates many layers into one incident and coordinates response across them.
- EDR isolation keeps console access while blocking other traffic.
What it is
Endpoint detection and response (EDR) is software that continuously records activity on endpoints, detects suspicious behavior and lets analysts investigate and respond from a central console. Extended detection and response (XDR) extends the same idea beyond endpoints, correlating telemetry from endpoints, network, email, identity and cloud into single incidents.
Both give the SOC faster, more complete response than traditional antivirus, which relies mainly on known signatures.
How it works
EDR capabilities
| Capability | What it gives the SOC |
|---|---|
| Continuous telemetry | Processes, command lines, file changes, registry changes, network connections, logons |
| Behavioral detection | Flags suspicious actions, such as Office spawning PowerShell, not just known files |
| Process tree and timeline | Shows how an attack unfolded, from parent to child process |
| Threat hunting | Search historic telemetry across all endpoints for an indicator |
| Remote response | Isolate host, kill process, quarantine or delete file, collect files, run a remote shell |
| Rollback (some products) | Reverse changes such as ransomware encryption |
An agent installed on each endpoint sends data to a cloud or on premises platform. Its main limit is coverage: devices without the agent are blind spots.
How EDR improves incident response
| IR stage | EDR contribution |
|---|---|
| Detection | Behavioral alerts with context, mapped to MITRE ATT&CK |
| Triage | Process tree and related events on one screen shorten validation |
| Containment | One click network isolation that still keeps the host reachable by the console |
| Scoping | Search every endpoint for the same hash, domain or command line |
| Eradication | Kill processes, delete files and remove persistence remotely |
| Lessons learned | Full timeline for the report |
Network isolation through EDR blocks the host's traffic except to the EDR platform, so analysts can keep investigating while the threat cannot spread.
XDR capabilities
XDR collects data from several security layers and correlates it automatically.
| Data source | Example signal |
|---|---|
| Endpoint | Malicious process or persistence |
| Phishing message with the same attachment | |
| Identity | Risky sign in or impossible travel |
| Network | Connection to a command and control address |
| Cloud | Unusual API calls or storage access |
Instead of five separate alerts, the analyst sees one incident that links the phishing email, the compromised account and the infected endpoint. XDR can then take coordinated actions, such as purging the email, disabling the account and isolating the host.
Native XDR uses one vendor's own products across the layers. Open or hybrid XDR ingests data from other vendors' tools through integrations.
EDR, XDR, SIEM, SOAR and MDR compared
| Tool | Scope | Main strength |
|---|---|---|
| Antivirus | Endpoint | Blocks known malware by signature |
| EDR | Endpoints | Deep host visibility and response |
| XDR | Endpoint, email, identity, network, cloud | Cross layer correlation and response |
| SIEM | Logs from almost any source | Central collection, correlation, search, compliance reporting |
| SOAR | Across tools | Playbook automation and case management |
| MDR | A managed service | Outside analysts running detection and response around the clock |
These tools work together: the SIEM provides wide log coverage and retention, EDR and XDR give deep detection and response, and SOAR automates the workflow.
Sysmon as an endpoint data source
Sysmon (System Monitor, part of Microsoft Sysinternals) is a free Windows service that logs detailed endpoint activity to the event log. It is not EDR, because it has no response actions, but its events feed the SIEM.
| Sysmon event ID | Activity |
|---|---|
| 1 | Process creation, with command line and hashes |
| 3 | Network connection |
| 11 | File created |
| 22 | DNS query |
A worked example
XDR raises one high severity incident: a user opened an email attachment, the endpoint ran an encoded PowerShell command, and minutes later the same account signed in from another country. The analyst reviews the linked evidence on a single page.
From the console the analyst isolates the laptop, disables the account and revokes its sessions, and purges the email from all mailboxes. A hunt across all endpoints for the attachment hash finds no other infections, and the incident is closed after reimaging.
How the exam asks about this
- "Which tool records process, file and network activity on endpoints and lets analysts isolate a host remotely?" → EDR.
- "Which solution correlates endpoint, email, identity and cloud signals into a single incident?" → XDR.
- "How does EDR isolation differ from unplugging the network cable?" → The host stays connected to the EDR console so investigation can continue.
What to remember for the exam
- EDR is behavioral endpoint detection plus remote response; antivirus is mainly signature based.
- XDR correlates many layers into one incident and coordinates response across them.
- EDR isolation keeps console access while blocking other traffic.
- SIEM collects and correlates logs widely; SOAR automates; MDR is a service.
- Endpoints without an agent are EDR blind spots.
EDR is not a SIEM. It sees deeply into endpoints but does not replace central log collection from firewalls, servers, applications and cloud services.
Common mistakes
Calling XDR just a bigger EDR. Its value is correlating different layers, such as email and identity, into one attack story.
Confusing Sysmon with EDR. Sysmon logs activity but cannot detect and respond on its own; it feeds a SIEM or other tool.
Assuming full coverage. Unmanaged devices and servers without agents leave gaps attackers use.
Check yourself
What does an EDR process tree show?
The parent and child processes in an attack chain, such as a document launching PowerShell that downloads a file.
What is the difference between native and open XDR?
Native XDR uses one vendor's products across layers; open or hybrid XDR integrates other vendors' tools.
Why does an analyst prefer EDR isolation over pulling the cable?
It stops the spread while keeping the host reachable for remote investigation and response.
Topic 6 of 6 in Incident Response
Test yourself on Incident Response
The full EC-Council 312-39 question bank has 700 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.