Design an endpoint detection and response platform: system design interview question

How the interviewer opens it

“Design a platform that collects endpoint activity, detects suspicious behavior, and lets a security analyst isolate a host. The platform must serve millions of devices, including devices that disconnect. Keep the agent's effect on each device small.”

The prompt is vague on purpose. The first minutes are for you. Reduce the prompt to the core features and agree on the numbers before you draw.

What to clarify first

Fleet and tenants
Activity volume
Agent limits
Read and write mix
Latency
Disconnections and durability
Consistency and availability
Retention
Detection scope
Response scope

The interviewer has the answers. In a SysRound round, Alex gives these answers, as a real interviewer does.

Scope of a strong answer

Core requirements

Collect selected process, network, and file activity within fixed agent limits.
Detect suspicious behavior and create alerts with supporting events.
Let an analyst view alerts and a host's activity.
Let an authorized responder isolate a host and release it from isolation.

Usually out of scope

Build operating system sensors or kernel drivers.
Train threat detection models.
Collect file contents or complete disk images.
Provide a remote shell or execute arbitrary code.

What interviewers ask about

Activity on disconnected devices: A fixed local buffer cannot preserve every event through a long disconnection. The agent must protect the host without hiding evidence loss.
Device connections at fleet scale: Reconnect traffic can exceed normal input by an order of magnitude. One large or compromised tenant must not block the rest of the fleet.
Suspicious activity across time: Events arrive late, twice, or out of order. Rules need bounded state, but analysts still need useful results from delayed evidence.
Host isolation and release: A response action changes a remote host's network access. Retries, stale commands, and partial changes can disconnect the only path for recovery.

Common mistakes

Promise lossless telemetry through long disconnections despite a fixed local disk limit.
Send every raw event without a local event policy or resource limits.
Let reconnect uploads consume the capacity needed for current events and response actions.
Wait for disconnected devices before evaluating current activity.
Treat command receipt as proof of isolation or let isolation block its own control connection.
Trust tenant fields from an endpoint or omit authorization checks for response actions.

The bar by level

Senior (L5/E5): Calculates fleet and reconnect load. Defines loss policy, durable receipts, late-event rules, duplicate suppression, action revisions, and safe isolation with a recovery path.
Staff (L6+/E6+): Defines failure and trust boundaries across the fleet. Quantifies recovery capacity and storage costs. Sets tenant fairness, evidence limits, safe rollout controls, and action recovery guarantees.

Sources · 1 reference

These records explain where the question appears. A company tag or candidate report does not guarantee a future interview question.

SysRound · 1 record

No company association
Design an endpoint detection and response platform
Reported date not specified
Source snapshot: Nov 12, 2026
View source

How the interviewer opens it

“Design a platform that collects endpoint activity, detects suspicious behavior, and lets a security analyst isolate a host. The platform must serve millions of devices, including devices that disconnect. Keep the agent's effect on each device small.”

The prompt is vague on purpose. The first minutes are for you. Reduce the prompt to the core features and agree on the numbers before you draw.

Scope of a strong answer

Core requirements

Collect selected process, network, and file activity within fixed agent limits.
Detect suspicious behavior and create alerts with supporting events.
Let an analyst view alerts and a host's activity.
Let an authorized responder isolate a host and release it from isolation.

Usually out of scope

Build operating system sensors or kernel drivers.
Train threat detection models.
Collect file contents or complete disk images.
Provide a remote shell or execute arbitrary code.

What interviewers ask about

Activity on disconnected devices

A fixed local buffer cannot preserve every event through a long disconnection. The agent must protect the host without hiding evidence loss.

Device connections at fleet scale

Reconnect traffic can exceed normal input by an order of magnitude. One large or compromised tenant must not block the rest of the fleet.

Suspicious activity across time

Events arrive late, twice, or out of order. Rules need bounded state, but analysts still need useful results from delayed evidence.

Host isolation and release

A response action changes a remote host's network access. Retries, stale commands, and partial changes can disconnect the only path for recovery.

Common mistakes

Promise lossless telemetry through long disconnections despite a fixed local disk limit.

Send every raw event without a local event policy or resource limits.

Let reconnect uploads consume the capacity needed for current events and response actions.

Wait for disconnected devices before evaluating current activity.

Treat command receipt as proof of isolation or let isolation block its own control connection.

Trust tenant fields from an endpoint or omit authorization checks for response actions.

The bar by level

Senior (L5/E5)

Calculates fleet and reconnect load. Defines loss policy, durable receipts, late-event rules, duplicate suppression, action revisions, and safe isolation with a recovery path.

Staff (L6+/E6+)

Defines failure and trust boundaries across the fleet. Quantifies recovery capacity and storage costs. Sets tenant fairness, evidence limits, safe rollout controls, and action recovery guarantees.