EDRData source
Endpoint protection
Endpoint detection and response: malware detections, credential-theft and lateral-movement alerts, quarantines, EDR tampering, USB connections, suspicious processes, DLP bypass attempts and the local admin inventory (8 signals).
Signals from this source
8- Attempts to bypass DLP DH-B-05 · DH
- Malware detected on their device EP-T-01 · EP
- Credential-theft, lateral-movement or privilege-escalation alert on their device EP-T-04 · EP
- Device quarantined or flagged compromised EP-T-05 · EP
- Local admin rights on endpoints EP-A-01 · EP
- Disables or tampers with EDR EP-B-01 · EP
- Connects USB storage EP-B-02 · EP
- Runs suspicious processes or unapproved software EP-B-05 · EP
Cite this term
"Endpoint protection" (EDR), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/sources/endpoint-protection
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · What's new in 2.0.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.