What ongoing capability does EDR provide to improve detection beyond automated alerts?

• A. Threat hunting across endpoints
• B. Data backup scheduling
• C. Hardware asset disposal
• D. Patch management cycles

Answer: (A)

Threat hunting across endpoints is the ongoing capability EDR provides to improve detection beyond automated alerts. EDR systems continuously gather rich endpoint telemetry—process trees, network connections, registry changes, file activity, and user behaviors—giving security teams the data needed to investigate proactively rather than rely solely on prewritten rules. This enables hypothesis-driven searches for suspicious patterns, post‑hoc analysis of unusual activity, and cross‑device correlation to reveal attacker techniques and attack paths that may not trigger automated alerts. By performing proactive hunting, analysts can uncover stealthy threats, validate detections, and iteratively refine rules and detections, reducing dwell time and strengthening overall security visibility. Data backups, hardware disposal, and patch management contribute to resilience and maintenance but do not provide the same proactive, investigative capability to improve detection across endpoints.