The Endpoint Detection and Response (EDR) component can be installed on each laptop or server to send its telemetry like opened processes, network connections, traffic, changes and other big data. It is then used for threat hunting, as it recognizes malicious IoC patterns, contains infected machines, and uses a dedicated channel to remotely connect and investigate the security threat.