EDR, Antivirus & Backups

Your JD asks for "Knowledge of backup solutions and antivirus/EDR tools". This is a ticket-driven topic as much as a technical one.

AV vs EDR

	Traditional AV	EDR
Detection	Signatures of known malware	Signatures plus behaviour and telemetry
Scope	Files in real time	Whole endpoint, continuously
Investigation	Limited — scan and hope	Full timeline, process tree, network connections
Examples	Defender for Antivirus, Trend Micro AV	Defender for Endpoint, CrowdStrike, SentinelOne

✖Prevention versus detection — know the difference

Prevention blocks execution outright. The user gets "this app was blocked" and cannot run it. Detection allows execution, then flags it. The user gets a quarantine notice and the file disappears later. Same root cause, completely different ticket, completely different conversation with the user.

Triage workflow

Get-MpComputerStatus |
  Select-Object AMServiceEnabled, AntivirusEnabled, RealTimeProtectionEnabled

Get-MpThreatDetection |
  Select-Object InitialDetectionTime, ThreatID, ActionSuccess, Resources

Get-MpThreat | Select-Object ThreatName, SeverityID, CategoryID

Field	Read it for
ActionSuccess	Did it actually contain it?
Resources	The exact file path — needed before any exclusion
InitialDetectionTime	Correlation with what the user was doing
SeverityID	High and critical get escalated, not excluded

Handling "my app is blocked"

The correct sequence:

1. What exactly is blocked? Full path, detection name, detection type.
2. Is it prevention or detection? Determines whether the file still exists.
3. Is it a known false positive? Check the vendor's exclusion guidance.
4. Is the file signed and from a known vendor? Trust anchor.
5. Get approval, then exclude — minimally.

# Restore a quarantined file
Get-MpThreatDetection | Where-Object {$_.InitialDetectionTime -gt (Get-Date).AddHours(-2)} |
  Select-Object ThreatID, Resources

# Define a narrow, explicit exclusion — never a whole drive or extension
Add-MpPreference -ExclusionPath "C:\Program Files\Vendor\App\app.exe"
Remove-MpPreference -ExclusionPath "C:\Program Files\Vendor\App\app.exe"

✖Never blanket-exclude

Excluding C:\, an entire Program Files tree, or a file extension disables protection for everything that shares that path. That is how ransomware arrives unopposed. Exclude one file, in writing, with an approval and a review date.

Defender essentials

# Cloud-delivered protection
Set-MpPreference -MAPSReporting 2
Set-MpPreference -SubmitSamplesConsent 1

# Exclusions — what is currently set?
Get-MpPreference | Select-Object -ExpandProperty ExclusionPath

# Scan history and a manual scan
Start-MpScan -ScanType QuickScan
Start-MpScan -ScanType FullScan
Start-MpWDOScan      # offline scan — catches rootkits

Concept	Why
Real-time protection	Should never be disabled to "fix" a problem
Tamper protection	Prevents users disabling Defender
Cloud-delivered (MAPS)	Uses live reputation data
Offline scan	Boots without drivers — finds rootkits

⚠The trap

Turning off real-time protection to install software, and never turning it back on, is one of the most common and most damaging things a new support engineer does. If it must be temporarily disabled, write down that you did it and re-enable it immediately after.

Backups

Type	Stores	Restore needs
Full	Everything	One set
Incremental	Changes since the last backup of any type	The entire chain
Differential	Changes since the last full	Full plus one

RPO and RTO

• RPO — how much data loss you can tolerate. Measured in time.
• RTO — how long you can be down. Measured in time.

Workload	Example RPO / RTO
File server	24 h / 8 h
Database	15 min / 1 h
Domain controller	1 h / 4 h

3-2-1

3 copies, 2 media types, 1 offsite.

# Windows Server Backup
Get-WinEvent -LogName 'Microsoft-Windows-Backup/Operational' -MaxEvents 10
wbadmin get versions

Tool	Notes
Windows Server Backup	Built in, adequate for small shops
Veeam / Acronis	Industry standard for VMs
Azure Backup	Offsite by definition
Restic / Borg	For Linux, deduplicated
rsync + cron	Linux servers, simple and effective

✖Verify the restore, not the backup

A green "backup completed" log proves the job ran. It proves nothing about restorability. Schedule periodic restore tests, and know the last one by date — that is the question an auditor asks first.

Backup failures you will meet

Symptom	Cause
"There is not enough space"	Destination full, or VSS snapshot reserve
"The backup could not be completed"	A file in use, or permissions
Free space drops during backup	Shadow copy storage reserve too small
Backup runs forever	The source is on slow storage, or over a WAN
Last restore test failed	The backup was never valid

Interview scenario

'My business app was blocked by antivirus' — how do you answer?

"I'd first establish whether it's prevention or detection, because that decides whether the user can still open the application. Then I'd get the exact file path and detection name from the console — never add an exclusion from a paraphrase.

Then I'd check whether it's a recognised false positive for that vendor. If it is, I'd raise a change with the file owner, exclude that specific file path rather than a folder or extension, record the approval, and set a review date. If it isn't a known false positive, I'd treat it as a potential compromise and escalate rather than silence it."

Next

Virtualisation.