Detecting endpoint detection and response solutions

This article explains how to check whether machines use a supported endpoint detection and response (EDR) solution.

Defender for Cloud includes EDR features for supported machines. It can:

• Detect whether a machine connects to a supported EDR solution.
• Integrate natively with Microsoft Defender for Endpoint as an EDR solution.

Check for an EDR solution

Defender for Cloud uses agentless scanning to check whether Azure VMs and AWS/GCP machines connect to an EDR solution.

Agentless scanning for EDR settings is available when you enable Defender for Servers Plan 2 or the Defender CSPM plan in your Azure subscription.

Based on the findings, Defender for Cloud provides recommendations to help you find and fix machines that don't have an EDR solution running:

• EDR solution should be installed on virtual machines
• EDR solution should be installed on EC2 instances
• EDR solution should be installed on virtual machines in GCP

Supported EDR solutions

The following table lists the EDR solutions supported by Defender for Cloud:

Next steps

Related content

Review and remediate the "EDR solution should be installed" recommendations for virtual machines, EC2 instances, and GCP VMs.