Antivirus asked whether a file matched something known to be bad. That worked while malware was scarce and reused, and stopped working when attackers started changing their binaries on every build.
Endpoint detection and response asks a different question: what is this process doing, and does that behavior make sense?
What EDR Actually Collects
An EDR agent records what happens on a machine at a level of detail that traditional logging does not reach. Process creation with full command lines and parent and child relationships. File creation and modification. Registry changes on Windows. Network connections attributed to the specific process that made them. Module loads. Authentication events.
That telemetry is the point. Even when a detection does not fire, having a recorded history of what ran on a machine is what makes investigation possible after the fact.
Why Behavior Beats Signatures
An attacker can change the file, the packer, the compiler, and the hash. What is much harder to change is the shape of what they need to do.
Something has to establish persistence, which means a scheduled task, a service, a registry run key, or a startup item. Something has to escalate. Something has to reach out to a controller. Something has to read or move data.
Detections written against those behaviors survive the attacker recompiling. That is why the modern attacker response is to live off the land, using tools already present on the system, which is exactly what behavioral detection was designed to catch.
XDR: What the X Adds
Extended detection and response widens the same idea beyond the endpoint, pulling in identity, email, network, and cloud signals so a single detection can span them.
The genuine benefit is correlation. A phishing email, followed by a sign in from a new location, followed by an unusual process on that user's laptop, is a much stronger signal together than any of the three alone.
The genuine caveat is that XDR usually works best when the pieces come from one vendor, which is why every large vendor sells it and every one of them defines it slightly differently. Read it as a product strategy as much as a technology category.
MDR: Somebody Else Watches It
Managed detection and response is a service where a provider runs the tooling and the monitoring for you, usually with an in house team handling triage and escalating real incidents.
For most small and medium organizations this is the sensible answer, because 24 hour coverage requires a headcount they will never justify. The thing to check carefully in the contract is what the provider is actually allowed to do when they find something, and how fast, because detection without authority to act just produces a phone call.
The Products You Will Meet
CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne, Palo Alto Cortex XDR, and Sophos Intercept X are the names that come up most often.
On the open source side, Wazuh and Velociraptor are widely used, and Sysmon on Windows produces much of the same telemetry for free if you have somewhere to send it.
How Attackers Try to Get Around It
Tampering with the agent, which is why tamper protection and alerting on agent health matter. An endpoint that stops reporting is itself a detection.
Living off the land, using PowerShell, WMI, certutil, or other built in tools so nothing unfamiliar ever runs. This is why command line logging is so valuable.
Operating where there is no agent: network devices, printers, cameras, appliances, and hypervisors. Attackers have moved toward these deliberately, and it is a strong argument for network level visibility alongside endpoint.
Moving fast enough that response does not happen in time, which is an argument for automated containment on high confidence detections.
What to Actually Check in a Deployment
Coverage. What percentage of assets have a healthy agent, and what is the list of things that do not. That list is usually more interesting than the dashboard.
Exclusions. Nearly every environment has performance exclusions added years ago that nobody has reviewed, and they are frequently on exactly the servers that matter most.
Whether detections are actually firing. The only honest way to know is to test, which is what breach and attack simulation is for.
Learn This at HackRange
Week 10 of the mentorship asks you to write detections and then attack them, which is where you find out what your endpoint tooling really catches.