XDR: meaning

In short

EDR looks inside the individual PC or server. A modern attack, however, passes through several places: it arrives by email, uses a cloud account, moves between machines. XDR collects the signals from all these sources and pieces them back together into a single incident, with the response actions close at hand.

How it works

An XDR system has three components:

• telemetry from several sources: agents on the endpoints, logins to cloud accounts, email events, firewall and network;
• correlation: rules and analysis link events that look normal when taken on their own;
• response: actions such as isolating a machine, blocking an address, suspending an account or removing software, started by an analyst or automatically according to agreed rules.

A distinction is made between "native" XDR, in which all the sources belong to the same product ecosystem, and "open" XDR, which integrates tools from different sources.

How it differs from SIEM and EDR

The boundary is blurred, and the term also started out as a marketing label. In short: EDR covers endpoints with detection and response; a SIEM collects and retains logs from any source, with correlation and alerts, but traditionally does not act; XDR takes the depth of analysis of EDR and extends it to other sources, with integrated response. In practice many companies use SIEM and XDR together: the first for retention and investigation, the second for reacting.

Why it matters

The most common attacks against SMEs do not use sophisticated malware: they use stolen credentials, access to Microsoft 365 or Google Workspace, legitimate system tools. On a single sensor they leave faint traces; put together, they are obvious. As with a SIEM, XDR delivers value when someone reads the alerts and decides: that is why it is often offered as a managed service (MDR).

Example

At 9:02 an employee receives an email with a link to a fake login page and enters her password. At 9:40 the account logs in to Microsoft 365 from a country never seen before. At 10:15 a PowerShell command that downloads a file is run from her laptop. Three events on three different systems: XDR links them to the same user within a single hour, and the analyst blocks the account and isolates the laptop in one operation.

Related terms

• EDR
• SIEM
• Phishing
• MITRE ATT&CK