█
LastWrite
  • > Curriculum
  • > Pricing
  • > For Educators
  • > About
  • > Contact
Log InGet Started

Questions, concerns, bug reports, or suggestions? We read every message, write to us at [email protected].

More ways to reach us →
LastWrite

Structured computer science lessons for aspiring developers and security professionals.

[email protected]

(201) 785-7951

Mon–Fri, 9 AM–5 PM EST

Learn

  • Curriculum
  • Pricing

Company

  • About
  • For Educators & Schools
  • Contact Us

Legal

  • Terms of Service
  • Privacy Policy
© 2026 LastWrite. All rights reserved.
Curriculum/Cybersecurity/End User Device Management/Endpoint Protection Platforms
40 minIntermediate

Endpoint Protection Platforms

After this lesson, you will be able to: Distinguish AV/EPP, EDR, and XDR; understand signature/heuristic/behavioral detection.

Antivirus has evolved. Modern endpoint security is EDR/XDR, recording everything an endpoint does, applying ML to spot anomalies. This lesson maps the acronyms and the detection methods.

Prerequisites:Operating System Security

EPP / EDR / XDR

EPP (Endpoint Protection Platform), modern AV (next-gen). Pre-execution prevention. EDR (Endpoint Detection & Response), records process, network, file activity. Post-breach detection + response actions. XDR (Extended Detection & Response), correlates across endpoints, network, cloud, identity. Whole-platform view.

💡 Three detection methods

Signature, known-bad hash matches. Fast, evadable. Heuristic, code patterns (e.g., self-modifying). Catches some unknowns. Behavioral, what the program DOES (mass file encryption = ransomware). Best for zero-days.

What an EDR shows you

  1. 1

    1. Process tree (parent → children, full lineage).

  2. 2

    2. Network connections per process.

  3. 3

    3. File modifications timeline.

  4. 4

    4. Registry changes (Windows).

  5. 5

    5. User logon events.

  6. 6

    6. Search across all endpoints in seconds.

Major vendors

CrowdStrike Falcon (market leader). Microsoft Defender for Endpoint (bundled with M365 E5). SentinelOne. Sophos. Palo Alto Cortex XDR. Open source: Wazuh, Velociraptor.

Quick Check

Zero-day ransomware detection works best with?

Pick.

Sign in and purchase access to unlock this lesson.

Sign in to purchase
←Operating System Security
Back to End User Device Management
Mobile Device Management→