Endpoint Detection and Response
What is Endpoint Detection and Response?
Security solutions that continuously monitor endpoint devices to detect, investigate, and respond to cyber threats using behavioral analysis and automated response.
Terms that appear alongside endpoint detection and response
Each of these is named in at least one of the same controls as endpoint detection and response. The number is how many controls name both.
- security operations 3 shared controls
- malware 3 shared controls
- cybersecurity 3 shared controls
- mitre 2 shared controls
- security monitoring 2 shared controls
- threat intelligence 2 shared controls
- user and entity behavior analytics 2 shared controls
- security information and event management siem 2 shared controls
Frameworks that govern endpoint detection and response
What the standards actually require on endpoint detection and response
Requirements naming endpoint detection and response across 6 standards, quoted from the control text.
Deploy Microsoft Defender for Endpoint on Azure VMs with continuous monitoring, alerting, and automated response.
ES-1 · Use Endpoint Detection and Response (EDR) →Endpoint detection and response software on all computers for centralised analysis and reporting of threat indicators.
ASD37-30 · Endpoint detection and response (Very Good) →FCEB agencies deploy an EDR initiative to support proactive detection of cybersecurity incidents in Federal infrastructure, active cyber hunting, containment and remediation, and incident response.
us-executive-order-14028-improving-the-nations-cybersecurity::7(b) · Sec. 7(b) Deploy an Endpoint Detection and Response initiative →Where feasible, security applications, for example endpoint detection and response and host-based firewalls, are a required part of device configuration.
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-3f · ARCHITECTURE-3f: Security applications required in device configuration →Implement risk-based controls including monitoring of authorized user activity and detection of unauthorized access or tampering, malware protection, annual cybersecurity awareness training including social engineering.
§500.14 · Monitoring and Training →Where suitable and/or supported, deploy host-based intrusion prevention on enterprise assets, for example an EDR (endpoint detection and response) client or an IPS agent running on the host.
CIS-13.7 · Deploy a Host-Based Intrusion Prevention Solution →Questions people ask about endpoint detection and response
What is Endpoint Detection and Response?
Why is Endpoint Detection and Response important for compliance?
Which compliance frameworks address Endpoint Detection and Response?
Where can I learn more about Endpoint Detection and Response?
See how Endpoint Detection and Response applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.