# EDR/XDR & Endpoint Telemetry

> Master the microscope of the SOC. Learn to leverage EDR/XDR platforms, analyze deep endpoint telemetry, and build high-fidelity detections against fileless and Living-off-the-Land attacks.

Canonical: https://codelivly.com/rooms/edrxdr-endpoint-telemetry
Last updated: 2026-07-06

| | |
|---|---|
| Level | Advanced |
| Category | Cybersecurity |
| Lessons | 4 |
| Estimated time | 30 min |
| XP | 200 |

Dive into the granular world of endpoint security. The EDR/XDR & Endpoint Telemetry module breaks down how modern Endpoint Detection and Response platforms capture kernel-level activity, process trees, and memory modifications.

You will learn how to analyze EDR telemetry, differentiate between EDR and XDR architectures, hunt for fileless malware, and write behavioral detections that catch Living-off-the-Land (LotL) techniques. By the end of this module, you will be able to extract maximum value from your endpoint agents and build resilient, host-based defenses that catch what traditional antivirus misses.

## Lessons

1. Antivirus vs EDR vs XDR Explained (30 min)
2. What Endpoint Telemetry Actually Captures (30 min)
3. EDR Detection Logic (30 min)
4. Popular EDR Platforms Overview (30 min)

## Related

- [Learning path: Endpoint & Network Security Monitoring](https://codelivly.com/learning-paths/endpoint-network-security-monitoring)
- [All rooms](https://codelivly.com/rooms)