Endpoint Detection and Response — workstation, server va boshqa endpointlarda faoliyat telemetrysini yig‘ib, zararli xatti-harakatni aniqlash, tekshirish va javob choralarini bajarishga mo‘ljallangan xavfsizlik tizimidir. EDR an’anaviy antivirusdagi file signature tekshiruvini process, network, registry, identity va vaqt bo‘yicha korrelyatsiya bilan kengaytiradi.
Sensor va telemetry
Endpoint agent process creation, parent-child bog‘lanish, command line, file change, module load, network connection va login hodisalarini kuzatishi mumkin. Operatsion tizim imkoniyati va privacy policy qaysi event olinishini belgilaydi. Kernel darajasidagi sensor kuchli visibility beradi, lekin stability va compatibility xavfi ham yuqori.
Telemetry markaziy backendga yuboriladi va device, user hamda process identity bilan bog‘lanadi. Offline endpoint local bufferda event saqlashi mumkin. Queue diskni to‘ldirmasligi uchun limit va priority mavjud; security-critical event debug telemetrydan ustun turadi.
Detection
EDR known malicious hash, behavioral rule, exploit signal va anomaly modelidan foydalanadi. Process tree kontekstida office ilovasining shell ochishi oddiy powershell.exe mavjud signalidan kuchliroq bo‘lishi mumkin. Signed binary ham living-off-the-land hujumida zararli maqsadda ishlatilishi mumkin.
Detection rule agentda real-time bloklash yoki backendda keng korrelyatsiya uchun bajariladi. Local rule tez va offline ishlaydi; cloud analysis ko‘p endpoint va threat intelligence kontekstiga ega. Qaysi signal qayerda bajarilishi latency, privacy va resursga bog‘liq.
Investigation
Analyst alertdan process lineage, file hash, user, network destination va boshqa hostlarda uchrashuvni ko‘radi. Remote query fleet bo‘ylab indicator qidiradi. Historical telemetry dwell time va initial accessni aniqlashga yordam beradi, retention esa investigation oynasini cheklaydi.
EDR dalili to‘liq haqiqat emas. Agent o‘chirilgan, event dropped yoki rootkit sensordan past qatlamda bo‘lishi mumkin. Network, identity, cloud va forensic ma’lumot bilan tasdiqlash kerak.
Response
Host isolation endpointni boshqaruv kanalidan tashqari tarmoqdan ajratishi mumkin. Process kill, file quarantine, credential reset yoki script bajarish boshqa amallardir. Har action scope, approval va rollbackga ega. Domain controller yoki ishlab chiqarish serverini avtomatik izolatsiya qilish katta uzilish keltirishi mumkin.
Agent tamper protection hujumchining sensorni o‘chirishini qiyinlashtiradi. Shu bilan birga administrator uchun signed emergency uninstall va recovery yo‘li bo‘ladi. Response command autentifikatsiya, audit va qisqa muddatli vakolat bilan himoyalanadi.
Operatsion boshqaruv
Coverage faqat agent o‘rnatilganligini emas, uning online, healthy, current policy va kerakli sensor holatini ko‘rsatadi. Deployment ring yangi agent versiyasini canary qurilmada tekshiradi. Performance overhead CPU, memory, disk va application latency bo‘yicha o‘lchanadi.
Exclusion compatibility uchun zarur bo‘lishi mumkin, lekin juda keng path yoki process istisnosi blind spot yaratadi. Har exclusion sabab, owner va expiry bilan review qilinadi. Detection outcome SIEM va case managementga yuborilib, umumiy incident timelinega qo‘shiladi.
Threat hunting bilan aloqa
Hunt analyst mavjud alertni kutmasdan gipoteza asosida historical endpoint telemetryni qidiradi. Topilgan pattern yangi detection rule yoki qo‘shimcha collection ehtiyojiga aylanishi mumkin. EDR query tili process, hash, signer va network entityni vaqt bo‘yicha pivot qilishga imkon beradi.
Remote live response kuchli, ammo forensik holatni o‘zgartirishi mumkin. Buyruq bajarishdan oldin maqsad, ruxsat va evidence collection tartibi belgilanadi. Memory yoki file olish privacy va legal policyga mos bo‘ladi. Agentdan kelgan timestamp endpoint clocki buzilgan bo‘lishi mumkin; backend receive time va boshqa source bilan timeline moslashtiriladi.
Bog‘liq tushunchalar
Endpoint security, Antivirus, XDR, SIEM, Detection rule, Host isolation, Threat hunting