Endpoint protection (EDR/XDR)
We deploy behavior-based endpoint protection on workstations and servers. Continuous monitoring comes from the vendor's managed detection and response (MDR) service; we handle the liaison with the vendor and look after the configuration. We take on this operational part under a custom agreement, within a scope agreed with the client.
When you need it
Signs that your endpoint protection has gaps
Many organizations assume their endpoints are fine because some kind of protection is installed on them. Any of the situations below means that is not enough.
Only traditional antivirus runs on the machines
Antivirus looks for the signatures of known malware. A large share of today's attacks are fileless and rely on legitimate system tools, such as a command shell or a scripting engine. Only protection that watches behavior can spot this in the process chain.
The servers were left out
Many rollouts stop at the workstations, yet attacks continue on the servers. Endpoint protection on the domain controller and the file server is especially valuable.
You can't search past activity for a new indicator
When an indicator of compromise comes to light weeks later, you need to know whether it has already appeared in your environment. You can only answer that if the system keeps telemetry as well as alerts.
The EDR is installed, but nobody watches it
Organizations often leave the EDR in monitor mode because they worry about blocking something by mistake, and for years nobody looks at a single alert.
How the rollout works
From inventory to handover
An EDR is only as good as its configuration, so there is work to do both before and after installation.
-
Inventory and choice of solution
We take stock of the endpoints and their operating systems, because wherever no agent runs, an attacker can work undisturbed. Based on the inventory, we decide whether configuring the existing solution is enough or a new product is needed. For new deployments we work with ESET and Trend Micro solutions.
-
Installation and rule set
We install the agent on the endpoints and build the rule set.
-
Tuning
The early period shows which legitimate tools trigger alerts. Each false positive needs a decision: an exception, a rule refinement, or acceptance. Exceptions stay narrow and documented.
-
Training and handover
Your administrators learn to use the console day to day and receive the final configuration in writing.
Deliverables
What you get at the end
items handed over
- Endpoint inventory and choice of solution
- Installation and rule set design
- 30-day tuning period
- Administrator training and handover documentation
Related services
What goes with endpoint protection
We covered the selection criteria and the metrics in our article on choosing an EDR.
Patch and update management
Centralized, scheduled management of updates for operating systems and third-party applications.
Email security
Protection against phishing emails, malicious attachments, and links, fitted to your existing email system.
Incident response retainer
Contractually agreed availability in case of a security incident: remediation, containing the spread, and recovery.
Frequently asked questions
The questions we hear most
What does XDR add to EDR?
XDR extends EDR to more data sources: beyond the endpoint, it covers the network, email, and the cloud. Individual alerts then add up to a connected attack chain. We have collected other technical terms in our glossary.
Do we need to replace our existing endpoint protection?
In most cases, no. Existing endpoint protection often supports behavior-based detection, but nobody has configured it. We recommend a new purchase only where there is a real capability gap.
What can be done where an agent cannot be installed?
Older systems often cannot run an agent. In that case you need a compensating control: strict segmentation and enhanced network monitoring. In industrial environments this is the usual situation, and we covered it in our article on OT endpoint protection.
Can the EDR feed into a SIEM?
It is worth checking this as early as the selection stage. EDR is one of the richest signal sources, and if its data cannot be exported, it stays isolated. We cover central log collection and correlation on our SIEM page.
