Endpoint Detection and Response

Modern attacks don't always come as a recognizable virus — they hide in legitimate processes, scripts, and stolen credentials. Endpoint Detection and Response is an endpoint detection and response (EDR) tool that continuously watches endpoint behavior for the tactics real attackers use, pairing with the antivirus included in your Endpoint Management for layered protection.

Key capabilities

• Continuous behavioral monitoring: Endpoint activity analyzed in real time for suspicious behavior, not just known malware signatures.
• MITRE ATT&CK-mapped detection: Detections aligned to the industry-standard framework of real-world attacker tactics and techniques.
• Fileless and evasive threat detection: Catches attacks that abuse legitimate tools and never write a file to disk.
• Endpoint isolation: A compromised device can be isolated from the network to stop lateral movement while it's remediated.
• Guided response: Alerts come with context and recommended response actions, so remediation is fast and precise.
• Cross-platform coverage: Protection for Windows, macOS, and Linux endpoints.

How it differs from antivirus

The managed antivirus in Endpoint Management blocks known malware. Endpoint Detection and Response watches for what antivirus can't see: suspicious behavior, fileless attacks, and misuse of legitimate tools. The two work as a pair — prevention first, detection for whatever slips past.

How it fits into your plan

EDR builds directly on Endpoint Management — same devices, deeper visibility, paired with the included antivirus. In Total Shield+, its detections also feed Managed Detection and Response, where a dedicated security operations team monitors and acts on them around the clock.

Availability

Included in Shield+ and Total Shield+. Compare plans →