Watch the endpoint
Check devices for malicious files and unusual network activity, and respond to Microsoft Defender events.
Catch the threat. Control the response.
Detect malicious files and network anomalies on devices, then set actions by severity and group. Quarantine, disable SASE access, or lock down an endpoint when your policy calls for it.
What is Endpoint Detection and Response (EDR)?
Endpoint protection that keeps watching and can take action.
EDR checks devices for signs of malicious activity. Jimber lets you configure detection for malicious files and network anomalies, then choose how to respond at each severity. Those response choices can help contain an affected endpoint while your team investigates.
How EDR works
Choose the signals to watch, decide how severe they are, and set the response in advance.
Judge the signal
Use detection sensitivity and severity to distinguish events that need attention from those that need immediate action.
Apply the response
Choose what happens at each severity, from quarantining a file to disabling SASE access or locking down a device.
Choose the response for each severity.
Select a group, tune malicious file detection, and choose when to quarantine, disable SASE access, or lock down a device. Network anomaly detection has its own response settings.
Why you should choose Endpoint Detection and Response
Act before threats spread
Contain a suspicious endpoint according to your policy instead of waiting for a manual decision on every alert.
Match the action to the risk
Set different actions for low, medium, high, and critical events rather than treating every signal the same way.
Protect work wherever it happens
Keep endpoint policy consistent for devices used in an office, at home, or on the move.
Give IT a clear control point
Tune detection and response by group in the same console as your other Jimber security controls.
Defender signals. Jimber response.
Bring Microsoft Defender into your endpoint response workflow.
Respond to Defender events
Use Microsoft Defender events to trigger the response you configure in Jimber, so your team can act when a protected endpoint needs attention.
Manage Defender on endpoints
Manage Microsoft Defender on your endpoints alongside Jimber's other EDR settings, with one place to oversee endpoint protection.
Key Capabilities
Configure the detection and containment actions that fit each group.
Malicious file detection
Choose the sensitivity of file detection for each group.
- Configurable detection sensitivity
- Response actions by severity
Network anomaly detection
Set actions when an endpoint shows suspicious network behaviour.
- Group based configuration
- Severity specific response
Containment options
Decide how Jimber should respond to a detected event.
- Quarantine malicious files
- Disable SASE access or lock down a device
SASE integration
Connect endpoint response with the access controls in Jimber SASE.
- Endpoint and access controls in one console
- Disable SASE access as a configured response
Why Jimber for EDR
Endpoint response and SASE access belong together. In Jimber, a detection can trigger an access response you configured, while the same console holds the policies for people, devices, and networks.
- Choose response actions by severity
- Configure protection for different groups
- Connect endpoint containment with SASE access
Detect what matters. Respond your way.
Explore how Jimber configures endpoint detection and response in one console.
FAQs about Endpoint Detection and Response
What is the difference between EDR and antivirus?
Antivirus focuses on identifying malicious files. EDR adds ongoing detection and response on the endpoint, including signals such as unusual network activity and configured containment actions.
Does every detection lock down a device?
No. You choose response actions by severity. A policy can quarantine a file, disable SASE access, lock down a device, or leave an action off for that severity.
Can we set different EDR rules for different groups?
Yes. The EDR Configuration screen lets you select a group, set detection sensitivity, and choose response actions for each severity.
What does disabling SASE access do?
It removes the affected endpoint’s SASE access when that response is enabled for a detected event. This helps stop it reaching resources through Jimber while the team investigates.
Does EDR look for network anomalies too?
Yes. Jimber’s EDR Configuration includes Network Anomaly Detection with response options by severity, alongside Malicious File Detection.
How does Jimber work with Microsoft Defender?
Jimber can respond to Microsoft Defender events and lets you manage Microsoft Defender on endpoints alongside your EDR settings.
How should we choose detection sensitivity?
Start with a setting that fits the group and review the resulting detections. Higher sensitivity can produce more false positives, so tune it with the response actions your team is ready to use.