EDR
EDR is endpoint detection and response: an agent on each endpoint that records activity and can isolate the host, kill a process, quarantine a file or run a script. Host containment almost always runs through the EDR, so a response platform's EDR actions matter most for time to contain.
Definition
EDR actions are the fastest to take and the easiest to scope, one machine at a time. They are also where a wrong action hits a user directly.
The scorecard counts six EDR actions: isolate, release isolation, kill process, quarantine file, run script and block hash.
EDR in D3 Security's documentation
D3 Security's platform page names CrowdStrike and SentinelOne, both EDR products, among its named integrations with Splunk, Sentinel, Okta, Zscaler and Fortinet, without an action-level list on the page read. vendor claim d3security.com, read
The example names a vendor and its own page. A vendor's use of EDR may differ from the definition above; the rubric uses the definition on this page.