# Design an endpoint detection and response platform: system design interview question

> Endpoint telemetry at fleet scale, with strict agent limits, delayed events, and safe host isolation.

Source: https://sysround.com/questions/design-endpoint-detection-and-response-platform
Updated: 2026-11-05


Difficulty: hard. Levels: Senior, Staff+.

## How the interviewer opens it

"Design a platform that collects endpoint activity, detects suspicious behavior, and lets a security analyst isolate a host. The platform must serve millions of devices, including devices that disconnect. Keep the agent's effect on each device small."

## What to clarify first

- Fleet and tenants
- Activity volume
- Agent limits
- Read and write mix
- Latency
- Disconnections and durability
- Consistency and availability
- Retention
- Detection scope
- Response scope

## Scope of a strong answer

Core requirements:

- Collect selected process, network, and file activity within fixed agent limits.
- Detect suspicious behavior and create alerts with supporting events.
- Let an analyst view alerts and a host's activity.
- Let an authorized responder isolate a host and release it from isolation.

Usually out of scope:

- Build operating system sensors or kernel drivers.
- Train threat detection models.
- Collect file contents or complete disk images.
- Provide a remote shell or execute arbitrary code.

## What interviewers probe

### Activity on disconnected devices

A fixed local buffer cannot preserve every event through a long disconnection. The agent must protect the host without hiding evidence loss.

### Device connections at fleet scale

Reconnect traffic can exceed normal input by an order of magnitude. One large or compromised tenant must not block the rest of the fleet.

### Suspicious activity across time

Events arrive late, twice, or out of order. Rules need bounded state, but analysts still need useful results from delayed evidence.

### Host isolation and release

A response action changes a remote host's network access. Retries, stale commands, and partial changes can disconnect the only path for recovery.

## Common mistakes

- Promise lossless telemetry through long disconnections despite a fixed local disk limit.
- Send every raw event without a local event policy or resource limits.
- Let reconnect uploads consume the capacity needed for current events and response actions.
- Wait for disconnected devices before evaluating current activity.
- Treat command receipt as proof of isolation or let isolation block its own control connection.
- Trust tenant fields from an endpoint or omit authorization checks for response actions.

## The bar by level

- **Senior:** Calculates fleet and reconnect load. Defines loss policy, durable receipts, late-event rules, duplicate suppression, action revisions, and safe isolation with a recovery path.
- **Staff+:** Defines failure and trust boundaries across the fleet. Quantifies recovery capacity and storage costs. Sets tenant fairness, evidence limits, safe rollout controls, and action recovery guarantees.

Practice this question with an AI interviewer: https://sysround.com/practice/new?problem=endpoint-detection-response


---
SysRound (https://sysround.com) is an AI practice tool for system design interviews. It has a voice or typed AI interviewer and a shared whiteboard. At the end, you get feedback on each skill and a model answer. The AI feedback can be wrong.