Plan 2 capability of Defender for Endpoint allowing a passive-mode Defender Antivirus to block and clean up threats found by EDR after a breach. It adds protection but doesn't resolve clashes between antivirus products.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains EDR in block mode in context, with comparison tables and the common traps.
Terms in this definition
- Capability
Something that a person, organisation or system is able to do.
- EDR
Defender for Endpoint's endpoint detection and response, which uses behaviour to detect and react to post-breach activity and continues even when Defender Antivirus is passive.