Now that the data is collected, algorithms and machine learning technology are starting to sift through it in order to highlight potential irregularities.
It can be considered that many EDR solutions are able to “learn” what normal user behavior and endpoint operations are and make decisions based on this analysis.
The gathered data can also be correlated across multiple sources as threat intelligence feeds. These are used in order to provide real-world examples of ongoing cyberattacks that can be compared to the activity within an organization.