How deeply does Data-Driven Cybersecurity cover endpoint detection and response?

Defines continuous monitoring and automated responses, but does not detail EDR deployment, configuration, or investigation workflows.

Endpoint detection and response

As explained in Data-Driven Cybersecurity

Endpoint detection and response is a security technology that continuously monitors endpoint activity, detects suspicious behavior, and supports or performs automated response actions.

Endpoint detection and response (EDR) continuously monitors endpoint activity, detects abnormal behavior, and triggers automated actions during security incidents. section 9.1

EDR supports a hybrid defensive approach by shortening dwell time, containing incidents quickly, and limiting their effects while security teams refine their defenses. section 9.1

Automated endpoint containment

When EDR identifies abnormal behavior, it can roll back malicious changes or quarantine an infected system, giving responders time to investigate and remediate the incident. section 9.1

How Data-Driven Cybersecurity covers it

liveBook manning.com

Read Data-Driven Cybersecurity on liveBook Get the book at manning.com

Related concepts

information security continuous monitoringuses · Information security continuous monitoring is the ongoing collection and analysis of systems, networks, controls, and activity to maintain security awareness and identify relevant changes, threats, or incidents.
threat detectionused by · Threat detection is the identification of activity or conditions that may indicate a security threat, attack, or compromise.

This explainer was generated by Manning's knowledge graph from the text of Data-Driven Cybersecurity. The section links point to the parts of the book it draws on.