In the ideal case, it logs everything your computer does, every process that's running, every system call they make, every Internet connection made, website vis

In the ideal case, it logs everything your computer does, every process that's running, every system call they make, every Internet connection made, website visited, etc, and reports it all back to a central data repository that's constantly being scanned for suspicious behavior. But more importantly, when a hack does occur, the security team can go back to that data lake and figure out exactly what happened. In reality, that's way too much data for anyone to make sense of, but giant companies spend tens of millions of dollars per year to deploy all the things so they can say they're doing it. On the other hand, funny things can happen. I got called out by the security team at one job because the EDR agent on my workstation registered that I had put a file on disk that had a malware signature. Well, it turns out that I had checked out the security team's git repo containing malware signatures... But I did get called out in about 20 minutes by a random security engineer I'd never met who told me the exact path on my PC where the file was. Is that a good thing? I'm not sure.