After this lesson, you will be able to: Distinguish AV/EPP, EDR, and XDR; understand signature/heuristic/behavioral detection.
Antivirus has evolved. Modern endpoint security is EDR/XDR, recording everything an endpoint does, applying ML to spot anomalies. This lesson maps the acronyms and the detection methods.
EPP (Endpoint Protection Platform), modern AV (next-gen). Pre-execution prevention. EDR (Endpoint Detection & Response), records process, network, file activity. Post-breach detection + response actions. XDR (Extended Detection & Response), correlates across endpoints, network, cloud, identity. Whole-platform view.
1. Process tree (parent → children, full lineage).
2. Network connections per process.
3. File modifications timeline.
4. Registry changes (Windows).
5. User logon events.
6. Search across all endpoints in seconds.
CrowdStrike Falcon (market leader). Microsoft Defender for Endpoint (bundled with M365 E5). SentinelOne. Sophos. Palo Alto Cortex XDR. Open source: Wazuh, Velociraptor.
Pick.
Sign in and purchase access to unlock this lesson.