What gaps does EDR leave that only the network shows?

Devices without an agent, agents that have been switched off, and the traffic pattern of an attack spread over several machines. EDREDR: endpoint detection and response. Security software installed on each computer that watches what happens on that machine. (endpoint detection and response) reports from inside each computer where it runs. It cannot report from a printer, a camera recorder, a NAS, a building controller, a guest phone or an unmanaged laptop someone plugged in. It cannot report from a server where it was uninstalled or tampered with. And each agent sees one host, so a slow pattern that only makes sense across many hosts, such as one machine touching dozens of file shares or quietly calling out every five minutes, is easy to miss. The network sees all of these because every device has to talk to do harm. NetSenX watches that traffic and keeps a network map of the devices it sees. It does not see inside a host, so the two tools complement each other.

This answer is part of the guide: NDR vs EDR vs SIEM (and XDR, MDR): how they differ

← All 40 questions on NDR, EDR, SIEM, XDR, MDRAll topics