Endpoint security is sold in acronyms, and vendors stretch each one to cover as much of the market as possible. The result is that two products with the same label can do very different things, while two products with different labels may overlap almost entirely. This guide strips each term back to the job it does, what it can see, and what it can do about it.
Antivirus and EPP: stopping known bad
Traditional antivirus compares files against signatures of known malware, with some heuristics for close variants. It is cheap and fast, and it still catches commodity threats, but it says nothing about an attacker who uses legitimate tools such as PowerShell, remote management software or stolen credentials.
An endpoint protection platform (EPP) is the modern evolution of antivirus. It adds machine learning models for unknown files, exploit and memory protection, behavioral blocking of ransomware patterns, device control for USB storage, a host firewall and often application control. The goal of an EPP is prevention: block the threat before it runs, quietly and automatically.
EDR and XDR: seeing what got through
Endpoint detection and response (EDR) assumes prevention will sometimes fail. The agent records process starts, command lines, network connections, file and registry changes, and sends that telemetry to a console where analysts and detection logic look for attacker behavior. When something is found, EDR lets you isolate the host from the network, kill processes, collect files and investigate the full chain of events.
Extended detection and response (XDR) applies the same idea across more than the endpoint. It correlates endpoint telemetry with identity, email, cloud and network signals, so a phishing email, a suspicious sign-in and a malicious process on a laptop appear as one incident instead of three unrelated alerts. "Native" XDR uses one vendor's products throughout; "open" XDR ingests third-party sources. In practice most XDR products start from a strong EDR.
DLP and UEBA: data and behavior
Data loss prevention (DLP) is about information rather than malware. An endpoint DLP agent classifies sensitive content, such as card numbers, national ID numbers or documents labelled confidential, and watches how it leaves the device: USB copies, uploads to personal cloud storage, printing, pasting into web forms including AI chat tools. Policies can log, warn the user, or block. DLP is also where most of the tuning effort goes, because a strict policy that blocks real work gets switched off.
User and entity behavior analytics (UEBA, sometimes shortened to UBA) builds a baseline of normal activity for each user, host and service account, then scores deviations: a finance user logging in at 3 a.m. from a new country, a service account suddenly reading thousands of files, an administrator using a tool they have never used. UEBA usually is not an agent at all. It is an analytics layer inside a SIEM or XDR platform that consumes the logs other tools produce.
The SIEM agent: a collector, not a defender
A SIEM agent, or log forwarder, ships logs from the endpoint to a central SIEM. Examples include the Splunk Universal Forwarder, the Azure Monitor Agent for Microsoft Sentinel, Elastic Agent and the Wazuh agent. Many teams pair it with Microsoft Sysmon on Windows to generate richer process and network events. The agent itself blocks nothing. Its value is giving the SOC a long-term, searchable record that survives even if the endpoint is wiped, and that can be correlated with every other source in the organization.
| Tool | Main job | What it sees | What it can do |
|---|---|---|---|
| Antivirus | Block known malware | Files on disk and in memory | Quarantine or delete files |
| EPP | Prevent attacks before they run | Files, exploits, device use | Block execution, control USB and apps |
| EDR | Detect and investigate intrusions | Process, network, file and registry activity | Isolate host, kill process, collect evidence |
| XDR | Correlate across the estate | Endpoint plus identity, email, cloud, network | Coordinated response across products |
| DLP | Stop sensitive data leaving | Content and how it moves | Warn, block, encrypt, log |
| UEBA | Spot abnormal behavior | Logs from many sources over time | Raise risk scores and alerts |
| SIEM agent | Collect and forward logs | Whatever logs it is configured to read | Nothing on the host; feeds the SOC |
Where the categories overlap
- Nearly every EDR product now ships with EPP prevention in the same agent, so buying both separately is usually wasted money.
- EDR telemetry overlaps heavily with what a SIEM agent and Sysmon collect. Many teams forward EDR alerts to the SIEM and keep raw telemetry in the EDR, which keeps ingestion costs down.
- Several XDR platforms include UEBA style analytics, and several SIEMs include XDR style correlation. Compare capabilities, not labels.
- DLP is the least overlapping category. EDR may see a file copied to USB, but it will not know the file contained customer data.
What to deploy, by maturity
- Small organizations with no SOC: a single EDR agent with prevention enabled, ideally with a managed detection and response (MDR) service watching it around the clock.
- Growing organizations: add identity and email signals through XDR, a SIEM for retention and compliance logging, and DLP for the data that regulators care about.
- Mature SOCs: a SIEM with UEBA as the long-term analytics layer, EDR or XDR as the primary detection and response tool, and SOAR to automate the routine actions between them.
One agent per job is fine. Five overlapping agents on every laptop is not: each one costs CPU, adds conflicts during updates and widens the attack surface. Consolidating onto fewer, well-run tools almost always improves security more than adding another category.
- EDR
- XDR
- EPP
- Antivirus
- DLP
- UEBA
- SIEM
- Endpoint security
