XDR
noun · also Extended detection and response
A security platform that correlates detections from endpoints, identities, email, cloud apps and more into single incidents with a shared response console.
Extended detection and response (XDR) grew out of EDR. Where EDR watches endpoints, XDR collects signals from several security layers, typically endpoints, identities, email and cloud applications, and correlates them automatically. The result is fewer, richer incidents: instead of five separate alerts from five products, the analyst sees one incident that tells the story across all of them.
XDR overlaps with the SIEM, but the two usually work together: XDR goes deep on the security products it integrates natively, while the SIEM collects logs from everything else, such as firewalls, custom applications and other vendors.
Example
Microsoft Defender XDR combines Defender for Endpoint, Defender for Office 365, Defender for Identity and Defender for Cloud Apps. A phishing email, the user clicking the link, a suspicious process on their laptop and an unusual sign-in to SharePoint appear together as one incident, and the analyst can isolate the device and disable the account from the same page.
Why it matters for a SOC analyst
In many SOCs, the XDR portal is where incidents are triaged. Understanding how it groups alerts helps you investigate faster and avoid closing one alert while the rest of the attack is still active. Its advanced hunting data is also one of the best places to practice KQL.
Articles that use this term
Certifications · · 3 min read
SC-200 study plan for SOC beginners
A six-week plan to prepare for Microsoft's Security Operations Analyst exam: what to study each week, how to practice for free, and the KQL you need to know.
Related terms
- EDR
Security software on laptops and servers that records process, file and network activity, detects malicious behavior and lets analysts respond.
- SIEM
A platform that collects logs from across an organization, correlates them and raises alerts, giving the SOC one place to investigate.
- SOAR
Tools that connect security products and run automated playbooks, so routine response steps happen in seconds instead of being done by hand.
- Security operations center
The team, processes and tools that monitor an organization around the clock, investigate alerts and coordinate the response to incidents.