Processes
Executions and relationships between processes.
ENDPOINT SECURITY • EDR • XDR
Protecting the endpoint is essential. Understanding what happens on it is the next level.
Laptops, desktops, and servers run applications, process data, and use identities that connect users to the organization’s most important resources.
That is why endpoint security needs to go beyond traditional prevention.
Add Solution designs and implements Endpoint Security, EDR, and XDR strategies that combine protection, telemetry, detection, investigation, and response to expand the ability to identify suspicious behavior and act on incidents.
USERPROCESSNETWORK
TELEMETRY / DETECTION
INVESTIGATECONTAINRESPOND
ENGENHARIA APLICADA
O endpoint precisa ser protegido e também produzir contexto para investigação.
A Add Solution combina cobertura, políticas, telemetria, detecção e resposta para transformar agentes instalados em capacidade operacional.
Arquitetura, execução e operação tratadas como partes da mesma responsabilidade.
WHERE ACTIVITY HAPPENS
Users run applications. Processes access data. Credentials are used. Connections are established.
Depending on the platform, endpoints provide context about processes, files, executions, users, connections, changes, behavior and security events.
Files
Creations, changes, and reputation when available.
Users
Identities and sessions related to the activity.
Connections
Communications initiated or received.
Behaviors
Sequences and signals that require analysis.
Protecting the device is important. Understanding its behavior expands our defense capabilities.
ANTIVIRUS, EPP, EDR & XDR
Prevention, visibility and correlation play different roles in the strategy.
Capabilities vary across vendors and architectures. That is why EDR is not just a more modern antivirus, and XDR is not simply another name for EDR.
01Traditional antivirusHistorically focused on malware identification and prevention, with techniques that have evolved over time.
02EPPCombines preventive mechanisms and endpoint protection controls according to the platform.
03EDRExpands telemetry, detection, investigation, and response capabilities for activities observed on endpoints.
04XDRIt can expand detection and correlation across endpoint, identity, email, network, and cloud, depending on the architecture and platform.
Better detection does not mean abandoning prevention.
Anti-malware, machine learning, reputation, exploit prevention, application controls, and behavioral and web protection may be included depending on the solution.
The best incident is still the one that can be prevented. The difference is being prepared for what could not be prevented.
Without evidence, an alert is only the beginning of a question.
Processes, process trees, files, users, connections, changes, and executions can be recorded and correlated, depending on the platform.
USER → PROCESS → CHILD PROCESS → NETWORK CONNECTION → FILE / ACTION
Telemetry transforms isolated events into investigable context.
Not every threat arrives with a known signature.
Behavior, event sequences, anomalies, techniques, reputation, intelligence, and analytical models may generate signals depending on the platform. Suspicious behavior does not automatically represent an attack.
Detection must identify signals. Investigation must determine what they mean.
When a threat is confirmed, speed must be accompanied by context.
Isolation, blocking, quarantine, process termination, artifact removal, remote actions, and evidence collection may be available, depending on the platform.
Automation reduces time in certain scenarios. Policy and context determine when to automate.
INVESTIGATION
Receiving an alert is different from understanding the incident.
Timelines, process trees, evidence, context, correlation and IOC/IOA where relevant help reconstruct the event and determine its scope.
01What happened?
02Which process started it?
03Which user was involved?
04What other actions occurred?
05Was there external communication?
06Do other endpoints exhibit the behavior?
07What is the scope?
Detection indicates that something deserves attention. Investigation determines what needs to be done.
Containing a device can limit the reach of an incident while the investigation continues.
When supported, network isolation can reduce communication, limit propagation, preserve investigative capabilities, and buy time for response—without guaranteeing absolute containment.
Ransomware is an attack process, not just the moment when files are encrypted.
Executions, credentials, movement, tools, behaviors, changes, and communications may generate signals before impact.
The sooner malicious activity is identified, the greater the opportunity to limit its impact.Backup & Disaster Recovery PAM & Identity Security
A compromised endpoint can also become a path to legitimate credentials.
Endpoints, users, credentials, sessions, privileges, and identity must be analyzed as parts of the same attack surface.
PAM & Identity Security Zero Trust & Secure AccessProtecting the first device matters. Limiting what can be reached from it matters too.
EDR/XDR, segmentation, NAC, firewall, identity, PAM, and monitoring play complementary roles in reducing reach.
Network Access Control (NAC) Network Security & FirewallA valid identity does not eliminate the need to understand the device being used.
Device trust, posture, risk, and endpoint signals can inform contextual decisions when integrated and supported.
Zero Trust & Secure AccessEndpoint Security does not end at the user's notebook.
Operating system, workload, criticality, compatibility, performance, and applications may require distinct policies for servers.
Servers & StorageThe device remains corporate even when it leaves the office.
Internet, SaaS, cloud, VPN or ZTNA, identity, policies, and telemetry make protection relevant wherever the endpoint is located.
Protection must follow the device, not just the company’s physical location.
EDR provides deeper endpoint visibility. XDR can broaden context across domains.
EDR: ENDPOINT → TELEMETRY → DETECTION → RESPONSE
XDR: ENDPOINT + IDENTITY + EMAIL + NETWORK + CLOUD → CORRELATION
Sources and capabilities vary by vendor and architecture.
An isolated event may seem commonplace. A correlated sequence may tell a different story.
ATYPICAL LOGIN + ENDPOINT ALERT + SUSPICIOUS CONNECTION + RESOURCE CHANGE → BROADER CONTEXT
Combining signals can broaden context where supported.
XDR and SIEM can work together without performing exactly the same role.
XDR correlates telemetry from controls or domains within its ecosystem. SIEM centralizes, searches and correlates events from diverse sources and can have a broader scope.
SIEM & SOCIntelligence adds context. It does not replace analysis.
Indicators, reputation, and context can enrich detections and investigations, depending on the platform.
More alerts do not necessarily mean more security.
Baselines, policies, justified exclusions, false positives, prioritization, context, and continuous review improve operational quality.
The goal is not to generate the most alerts. It is to improve the quality of decisions.
DEPLOYMENT
Installing agents is only one part of the project.
Inventory, operating systems, servers, workstations, applications, compatibility, groups, policies, exclusions and integrations determine the deployment engineering.
01DiscoverInventory, systems, and applications.
02ClassifyWorkstations, servers, and workloads.
03Define policiesControls, groups, and justified exceptions.
04PilotValidate compatibility within a controlled scope.
05DeployRoll out the technology progressively.
06ValidateConfirm protection, telemetry, and behavior.
07IntegrateConnect identity, network, SIEM, and operations.
08OperateTriage, investigate, and respond.
09EvolveImprove policies and detections.
Deployment installs technology. Engineering turns technology into a control.
ASSESSMENT
Can your endpoint protection only block threats, or can it also explain what happened?
We assess coverage, controls, integrations, and the operational process to identify concrete opportunities for improvement.
01Coverage
02Policies
03Telemetry
04Detections
05Servers
06Endpoints
07Exclusions
08Integrations
09Alerts
10Response
11Operational visibility
CONTINUOUS OPERATIONS
EDR without follow-up can turn telemetry into an alert queue.
Monitoring, triage, investigation, prioritization, escalation, response, tuning, and continuous improvement turn signals into decisions.
SIEM & SOC Services & OperationsADD SOLUTION METHOD
Prevent, observe and respond as one integrated strategy.
More than 15 years of experience connecting endpoints to networking, identity, firewall, NAC, PAM, backup, observability, and operations in critical environments.
- 01
Understand
Environment, users, applications, and risks.
- 02
Classify
Endpoints and workloads.
- 03
Protect
Apply appropriate controls.
- 04
Observe
Generate relevant telemetry.
- 05
Detect
Identify behaviors that warrant investigation.
- 06
Investigate
Determine context and scope.
- 07
Respond
Contain and remediate according to process.
- 08
Evolve
Improve policies and detections.
TECHNOLOGIES & PRODUCTS
Architecture, implementation, integration, and operations.
Vendors and platforms are covered on the technology pages. The strategy starts with the protection needed, the evidence and the response process.
Cybersecurity Technologies & ProductsPERGUNTAS FREQUENTES
Decisões importantes sobre Segurança de Endpoints (EDR/XDR)
Respostas objetivas para dúvidas técnicas e operacionais que costumam surgir antes de um projeto.
01EDR é apenas um antivírus moderno?
Não. EDR amplia telemetria, detecção, investigação e resposta sobre atividades observadas no endpoint.
02EDR e XDR são a mesma coisa?
Não. EDR aprofunda a visão do endpoint; XDR pode correlacionar sinais de diferentes domínios conforme plataforma e arquitetura.
03XDR substitui SIEM?
Não universalmente. XDR e SIEM podem coexistir e integrar-se, com escopos e funções diferentes.
04EDR impede ransomware?
Não existe garantia absoluta. EDR pode ampliar prevenção, detecção, investigação e resposta, integrando-se a outros controles.
05Todo alerta representa um incidente?
Não. Alertas são sinais que precisam de contexto, priorização e investigação.
FALE COM UM ESPECIALISTA
Vamos conversar sobre Segurança de Endpoints (EDR/XDR).
Share the context of your environment, the perceived impacts and the results your organization seeks. Add Solution will direct the conversation to the most appropriate experts.
CONTEXTO DA CONVERSASegurança de Endpoints (EDR/XDR)Origem e interesse são registrados automaticamente no atendimento.