EDR analysis