Fortinet’s endpoint detection and response platform (EDR) got an overhaul during this week’s RSA virtual conference. The predictably named FortiEDR gains new managed detection and response (MDR) and Mitre threat tags.

As the name suggests, FortiEDR and other EDR products provide security protections that combine real-time monitoring and analysis of endpoint activity to automate threat response and track suspicious behavior.

“Unlike traditional endpoint protection platform products that bolt on endpoint detection and response, or first generation EDR solution that added EPP later, FortiEDR is the only solution that was built as a unified solution from the start,” said Fortinet CEO John Maddison, in a statement.

According to Fortinet, today’s update will better prepare businesses of any size to secure worker’s computers on and off the network, prevent attacks pre- and post-execution, and allow security teams to detect and mitigate suspicious activity remotely using the platform’s MDR capabilities.

Aiding this process is the use of Mitre adversarial tactics, techniques, and common knowledge (ATT&CK) tags. These tags contain information about known threat behavior throughout the attack processes.

However, Fortinet argues its FortiEDR offering is unique from the competition because it doesn’t rely solely on threat databases to block attacks, an approach it calls a “blunt tool.” Instead, FortiEDR augments threat intelligence with real-time endpoint analysis, which scans for anomalous activity and uses this information to automate protective measures. The platform can also roll back malicious changes without taking machines offline to re-image them.

“It seamlessly provides behavior-based protection and response at both pre-infection and post-compromise stages,” Maddison said.

Fortinet claims this approach is not only more accurate, resulting in fewer false positives, but is capable of detecting zero-day and supply chain attacks.

Today’s updates come a few months after the security vendor jumped headlong into the extended detection and response (XDR) market with, you guessed it: FortiXDR.

XDR combines elements of security information and event management (SIEM); security orchestration, automation, and response (SOAR), EDR, and network traffic analysis (NTA) in a software-as-a-service (SaaS) platform.

Over the past year, several EDR vendors, including CrowdStrike and McAfee, have made the jump from EDR to XDR. Meanwhile Gartner recently ranked Microsoft and CrowdStrike among the top endpoint platform vendors.

Despite all the buzz surrounding XDR, EDR remains popular according to Fortinet, which said its FortiEDR platform grew more than 300% over the past year, due in large part an increase in ransomware attacks.

One of those customers is the Alberta Urban Municipalities Association (AUMA), which recently deployed Fortinet’s EDR platform.

“With FortiEDR and the Fortinet Security Fabric, our security infrastructure will automatically block and tackle. In our legacy environment, if our endpoint solution detected something, internal staff had to enter it on the MSP’s help desk portal, Shaun Guthrie, senior director of IT at AUMA. “In contrast, if FortiEDR detects an issue, it will cut it off right away. The time to response is almost immediate.”