Life Inside the EDR: We Have a YouTube Channel Now, and a Song
What an EDR actually does, explained through a French house anthem about lateral movement and people who log in as admin/password. Also, our marketing team spent three years of budget on it.
Two announcements. First, sochub has a YouTube channel: youtube.com/@sochub-io. Second, the first thing on it is not a product demo. It is a four-on-the-floor dance track with a vocoder spelling out S-O-C, M-F-A, E-D-R.
A word from the marketing department
Our marketing team, which is one person, and that person is also the backend, was given a three-year budget and told to raise awareness. The entire budget has now been spent. It went to a Suno subscription, which wrote the song, and a Claude Opus 5.5 subscription, which made the video. Combined, the two cost less than one conference booth, and unlike the booth, neither of them asked us for a lanyard.
The marketing team reports that it is very happy. The marketing team would also like you to subscribe to the channel, because the next three years are unfunded.
Nobody on the team can sing. This is relevant to why the vocals are AI, and to why you should never ask us to do karaoke at a conference.
OK but what is an EDR
Since the song is called Life Inside the EDR, and since half the people who watched it asked, here is the short version.
An EDR is Endpoint Detection and Response. It is an agent that runs on every laptop and server you own and watches what happens there: which processes start, which files get written, which network connections open, who logs in. Antivirus looks at a file and asks “is this known to be bad?”. An EDR watches behaviour and asks “is this acting bad?”, which is how it catches a legitimate tool like PowerShell being used to dump passwords.
The “Response” half is the part people forget. From the EDR console you can kill a process, pull a file for analysis, or isolate a host: cut it off from the network entirely while keeping it reachable by the EDR itself, so the attacker loses their foothold and you keep your evidence. That one button is the difference between an incident and a breach notification.
What an EDR does not do is run your incident. It fires alerts. Someone still has to decide which of today’s four hundred detections matter, work out how the attacker got in, contain them, kick them out, and write down what happened. That is the life inside the EDR, and it is what the song is about. It is also what sochub is for, but we will get to that.
The song, annotated
For anyone outside the SOC who watched the video and wondered why their security colleagues were laughing.
Three A.M. and the dashboard is glowing, I’m tracking the traffic to see where it’s going!
Detection. Accurate down to the hour. Serious incidents start as one alert among hundreds, usually at the worst time, and the first job is deciding whether it is real.
I pull up the hash, block the IP at the door, But the E-D-R dashboard is begging for more!
Looking up a file hash and blocking an IP are the two most common first moves. They are also the two things most often forgotten by the time anyone writes the report.
Did you open that file? Enabled the macros? (It’s been a while!) They dumped all the creds, now they’re in the clear!
Root cause. Someone enabled macros, the macro dropped a credential dumper, and the attacker now has passwords and no longer needs malware to move. This exact sequence has opened more incidents than any zero-day ever will.
Ah, yes. “Admin” and “Password”. The absolute pinnacle of zero-trust architecture.
The spoken-word breaks are the sarcastic voice every responder keeps in their head and mostly out of the postmortem.
We are hunting down the lateral movement! Analyzing payloads in the sandbox tonight! Gotta isolate the host, keep the network tight!
Containment. Lateral movement is the attacker hopping from the first machine to others with the stolen credentials. The sandbox tells you what the payload does. Isolating the host is the EDR button from the section above, and this is the moment you press it.
Who let the fridge talk to the routing machine?
Every network has a fridge. Or a printer, a badge reader, a lobby TV. Something nobody owns, nothing should talk to, and attackers adore.
I’m pulling the PCAP, checking the bytes, Revoking credentials and revoking rights! I write up the YARA, I trigger the SOAR, I’m booting the adversary out of the door!
Eradication. Packet captures to confirm what left. Every stolen credential revoked, every session killed, every permission the attacker granted themselves removed. A YARA rule so the same malware is caught on sight next time. Automation so the same response runs in seconds instead of a shift.
You whitelisted the entire network because the firewall pop-ups were “annoying.” Brilliant strategy. Truly breathtaking.
We have all seen this ticket.
Isolate. Mitigate. Remediate.
The mantra. Stop the bleeding, reduce the damage, fix the thing that let it happen. It belongs on a vocoder loop because responders repeat it that often.
I find your lack of MFA… actually pathetic.
The single highest-value line in the song. Most of what the verses describe stops at the first login screen if multi-factor authentication is on.
Ticket closed. Please read the security policy next time.
Lessons learned. The case closes, everyone promises to take the postmortem seriously, and the dashboard glows again at 3 A.M.
Where sochub fits
The EDR gives you the alert and the isolate button. Everything in between, which is most of the song, is the case: the hash you looked up, the host you isolated and when, the credentials you revoked, the fridge you finally put on its own VLAN, and the report at the end. sochub is the open-source, self-hosted place where that work lives, and it pulls alerts straight from CrowdStrike, SentinelOne and Microsoft Defender and can run the isolate from the case itself. The previous post walks through that path step by step. The code is at github.com/sochub/soc-hub.
Subscribe to the channel for more. There will be demos eventually. There may also be a ballad about patch Tuesday. The marketing team has not ruled it out, and has no budget left to be stopped with.
And if you have ever enabled the macros, we are not judging. The song is.