Part 2 of the 5-part ‘EDR in the Real World’ series. In the previous article, I laid out a framework for testing whether an