Explain how EDR can support detection and incident containment.

### The concept EDR observes activity on endpoints and retains records such as file changes, configuration changes, and user account actions. Detection can compare these observations with known attack indicators or a baseline of expected behavior. The resulting telemetry helps analysts investigate possible events. EDR is also described as important during incident containment, when teams take action to limit an incident's effects. ### What a good answer covers - Explain that EDR records endpoint activity continuously. - Name attack indicators or baseline deviations as detection inputs. - Describe how stored telemetry supports review or correlation. - Link EDR's front-line detection role to containment work. ### Terms - **Incident containment**: Actions taken to limit the effects or spread of an incident. - **Indicator of attack**: A sign associated with a possible attack. ### Remember EDR supplies endpoint evidence that supports detection and containment decisions.