EDR and antivirus: prevention, investigation and response
Modern antivirus does more than match known files. EDR adds investigation and response capabilities. Check the coverage and who acts on the alerts.
The cover image is an AI-generated editorial illustration. Screens and documents are illustrative concepts.
Antivirus and endpoint detection and response, EDR, have overlapping but different jobs. Antivirus focuses on preventing and blocking malicious activity. EDR adds telemetry, investigation and response capabilities that help a team understand suspicious activity and contain it.
Modern antivirus is not limited to a list of known bad files. Behavioural analysis, machine learning and other techniques can also contribute to prevention. CrowdStrike’s comparison of EDR and next-generation antivirus describes how those capabilities complement one another.
What an investigation needs
After an alert, the team may need to establish which process started, what account it used, where it connected and whether related activity occurred elsewhere. EDR can provide evidence for those questions within its collection and retention limits.
A response capability may allow an authorised operator to isolate a host or stop a process. Falcon Insight XDR is CrowdStrike’s endpoint detection and response offering within the wider platform.
No product records literally everything. Confirm the supported operating systems, event coverage, retention and conditions under which a device stops reporting.
Check the suite you already have
The required capabilities may already be included in an existing subscription. Verify that they are licensed, enabled and operating on the intended devices.
Prevention and EDR do not necessarily mean buying or installing two separate products. Running overlapping endpoint agents without checking compatibility can create its own operational problems.
Evaluate coverage against plausible incidents: credential theft, suspicious scripting, persistence and movement between systems. Include the identities and cloud services outside the endpoint’s direct view.
An alert needs an operating arrangement
Decide who reviews detections, how quickly they must respond and which containment actions they can authorise. A technically available action may still require business context, particularly on a critical server.
With Falcon Complete, CrowdStrike provides the managed detection and response team within the purchased service scope. FM’s role in that offering covers onboarding, tuning and local escalation. FM’s MDR page describes the service.
The buying question is therefore about both capability and operation: can the tools supply useful evidence, and can the responsible team act on it when it matters?
