Chapter Overview
Status: 🟡 NOT STARTED
- Antivirus (signature and heuristic scanning)
- EDR (Endpoint Detection and Response — behavioral monitoring, telemetry)
- Windows Defender architecture recap and deepening
- Firewall as endpoint control point
- Application control (allow-listing)
- Sandboxing as containment strategy
- Security logs as the evidence trail