The purpose of this article is to share the Top 10 EDR Criteria for an EDR solution. Picking out an EDR solution is not an easy task. The market has been flooded by vendors that have bolted on EDR as an extension of their core product. Outside of looking at the MITRE Engenuity ATT&CK Evaluations, organizations must do a needs assessment. This will help them to find out which functions present the highest value to their organization. I have selected 9 of the most popular assessment criteria and provided a review of each and how they might fit into your organization.
Your goals in selecting an EDR solution should be twofold. First, you want to use an EDR solution to prevent an attack. Your second goal is to minimize the dwell time of an attacker if they do thwart security mechanisms. It is important to keep these goals in mind as you review each section of the top 10 considerations for an EDR solution. These top 10 considerations for an EDR solution are listed in no particular order in terms of value or ranking from highest to lowest.
1. Analytics
EDR solutions use various analytics techniques to detect indications of attacks. These analytics engines process billions of events across the entire organization looking for suspicious behavior and automatically sending an alert. Your EDR solution should allow you to write your own custom searches to look back as far as 90 days once you have identified an attack.
2. Visibility
Your EDR solution should provide you with real-time and historical visibility. Having visibility is like giving your security team video footage of how an attack occurred, and then allows them to watch the perpetrators as they are going through the environment. Visibility should allow you to see things like process executions, user accounts that have been used, local and external addresses which the host is connected, and many other artifacts.
3. Integration and Compatibility
You may have other security tools which you would want your EDR solution to integrate with. Integration is important for automating response from other security tools like the network firewall or Network Access Control (NAC) solution. It is also important for feeding into a SIEM tool and providing a SOC the necessary data they need.
You also need to make sure that your EDR solution will cover all the workloads you intend to cover. Not all EDR solutions are created equally, and some will cover just Windows-based and Mac-based operating systems. You may not need more than that but if you have Linux or containers and want those protected, you will need to make sure your EDR solution supports that.
Contact an EDR Specialist
An EDR specialist can help you perform a needs assessment. They can get to know your goals and environment to help you narrow down the right solution. If you would prefer to speak to an experienced EDR specialist, please fill out the form below.
4. False Positives and Alert Fatigue
One of the biggest time-consuming parts of having a security tool like EDR or a SIEM is managing false positives. False positives create alert fatigue. Alert fatigue can be responsible for security analysts getting into the habit of ignoring alerts when they see so many of them that are false positives, or not really a true reason for an alert. A false positive is the same thing as the boy who cries wolf. He cried it one too many times and then when the real thing came upon him no one believed him. You do not want that to happen to your environment.
A common mistake for EDR customers is that they underestimate how much time and resources are required for an EDR solution. An IT generalist put in front of an EDR and asked to learn it while performing other jobs is a recipe for failure. EDR solutions should be managed by security analysts who are solely dedicated to managing an EDR solution for an organization. You should seek managed security services if this is a model you cannot support.
5. Protection and Prevention
An EDR solution should have strong protection and prevention techniques to block incoming attacks and removing them from the environment if they have succeeded. These functions include automatically blocking process and file executions, quarantining malware and taking the machine off the network. These functions are typically right at the fingertips of the security analyst monitoring the EDR console and should be included in your EDR solution.
6. Remediation and Forensics
Your EDR solution should be able to provide remediation suggestions to restore affected devices and systems. It should also be able to provide a replay of how an attack happened for forensics by quickly collecting data and enriching it with correlated activities, logs, and data streams.
7. Managed Services
Organizations that do not have SOC analysts to continuously manage and monitor an EDR solution should seek a managed security services arrangement. Many of the EDR solutions on the market today sell managed services as an option provided by their own in-house SOC. Others leverage third-party organizations like SecureWorks, Red Canary, and others.
Contact an EDR Specialist
An EDR specialist can help you perform a needs assessment. They can get to know your goals and environment to help you narrow down the right solution. If you would prefer to speak to an experienced EDR specialist, please fill out the form below.
8. Additional Features and Value-adds
Every EDR solution is unique and different in their own way. Many of them offer integrations that others do not or have features that are unique, like Sandboxing. You should perform a needs assessment to understand what you have today, what additional protections you want, and how the new EDR solution will fit into your ecosystem of tools and your culture.
9. Price and Total Cost of Ownership
Price and total cost of ownership will of course play a role into the final decision of an EDR solution. You need to keep in mind the cost of management, whether that will be in house or outsourced to a managed services provider. Additionally, you should consider the cost reduction of an endpoint protection platform if the EDR solution will replace that.
You can likely get multi-year discounts for choosing a longer-term agreement. But you should trial the product or have experience with it before making that decision. Many EDR solutions, like CrowdStrike will let you trial their product to see how it will perform in your environment.
10. MITRE ATT&CK Engenuity Evaluations
One thing you should note about EDR solutions is that it’s not just about your fulfilling your needs at the moment. You should look at the MITRE ATT&CK Engenuity Evaluations test scores over the course of time. This will help you understand how consistent they are at protecting their customers over the years.
Conclusion – Top 10 EDR Criteria
These top 10 EDR criteria provide a selection of the most important evaluation criteria for an EDR solution. You should create a matrix that includes these 10 criteria in your evaluation process. Using a matrix will allow you to score each criteria with a score. By scoring EDR solutions, you can narrow down your selections easily and make the right decision. If you’re looking for an EDR solution, make sure to check out our Ultimate Guide to the Top 10 EDR solutions.
Contact an EDR Specialist
An EDR specialist can help you perform a needs assessment. They can get to know your goals and environment to help you narrow down the right solution. If you would prefer to speak to an experienced EDR specialist, please fill out the form below.