What is a software agent that collects system data and logs for threat analysis?

What is a software agent that collects system data and logs for threat analysis?

• A. SIEM
• B. Endpoint detection and response (EDR)
• C. Network Traffic Analyzer (NTA)
• D. Intrusion Prevention System (IPS)

Answer: (B)

The main idea is a software component that runs on endpoints and continuously gathers data about the device’s activity to support threat detection and investigation. This kind of agent collects detailed telemetry from the system—things like process creation and termination, file and registry activity, memory behavior, and network connections—and forwards it to a central console for analysis. With this data, security teams can identify suspicious behavior, correlate events, and respond to incidents. That’s precisely what endpoint detection and response does. It’s built to sit on each endpoint, collect rich telemetry, and provide detection, investigation, and response capabilities based on that data. It goes beyond just logging by enabling real-time or near-real-time analysis and containment actions when threats are detected. Other options don’t fit this role as tightly. A SIEM focuses on aggregating and correlating logs from many sources across the environment, not the per-endpoint data collection and live analysis required for threat detection on each device. A network traffic analyzer looks at network flows and communications rather than the internal activity on a device. An intrusion prevention system operates inline to block threats at the network or perimeters level, rather than acting as a telemetry-gathering agent on endpoints for analysis.

The main idea is a software component that runs on endpoints and continuously gathers data about the device’s activity to support threat detection and investigation. This kind of agent collects detailed telemetry from the system—things like process creation and termination, file and registry activity, memory behavior, and network connections—and forwards it to a central console for analysis. With this data, security teams can identify suspicious behavior, correlate events, and respond to incidents.

That’s precisely what endpoint detection and response does. It’s built to sit on each endpoint, collect rich telemetry, and provide detection, investigation, and response capabilities based on that data. It goes beyond just logging by enabling real-time or near-real-time analysis and containment actions when threats are detected.

Other options don’t fit this role as tightly. A SIEM focuses on aggregating and correlating logs from many sources across the environment, not the per-endpoint data collection and live analysis required for threat detection on each device. A network traffic analyzer looks at network flows and communications rather than the internal activity on a device. An intrusion prevention system operates inline to block threats at the network or perimeters level, rather than acting as a telemetry-gathering agent on endpoints for analysis.