The SEDR 4.7 software relies on the SEP client's detection of virus and malware files. The SEDR appliance in Scanner or All-in-One mode scans binary files transmitted across the network in plain text using the most current set of virus definitions.
For more information on what technologies SEDR uses for detection, see this Help page.