EDR
Endpoint detection and response. Behaviour plus the ability to isolate. An agent without an owner is inventory.
EDR watches endpoints for suspicious behaviour and gives responders a way to investigate and isolate. Antivirus looking up hashes is a subset.
Coverage matters: workstations, servers, the jump box everyone forgot. So does the right to isolate without a change board.
Tune noisy detections. An EDR that pages 400 times a night will be ignored on the 401st, which will be the real one.