4.4.3. Microsoft Defender for Endpoint

💡 First Principle: Defender for Endpoint is an endpoint detection and response (EDR) platform — it doesn't just block known malware signatures like traditional antivirus, it continuously monitors device behavior for suspicious patterns (unusual process activity, lateral movement attempts) that indicate an active compromise already underway, even from previously-unseen threats.

Beyond detection, Defender for Endpoint provides response actions — isolating a compromised device from the network, or killing a malicious process remotely — directly from its console, and feeds its signals into Defender XDR's unified incident correlation (4.4.1).

⚠️ Exam Trap: Traditional antivirus primarily blocks known-bad signatures; EDR (like Defender for Endpoint) is built to detect behavioral indicators of compromise even when no known malware signature matches — don't describe Defender for Endpoint as "just antivirus."

Reflection Question: Why can behavior-based detection catch a threat that signature-based antivirus would miss entirely?