Extended Detection and Response (XDR)

Extended Detection and Response (XDR) is the extension of the EDR concept beyond endpoints to further security domains. These typically include data from identities, cloud environments, email, network or applications. The added value arises above all from the fact that signals from different sources are correlated and placed in a common context. Attacks can thus be understood as a coherent chain instead of only looking at individual, isolated alerts. For analysts, the flood of alerts often decreases, while prioritization and investigation become more efficient at the same time.

XDR is particularly interesting where organizations operate many individual solutions and need a consolidated picture of the situation. The approach is also relevant for faster responses, because automated workflows across several security areas become possible. In practice, however, XDR is convincing above all when data quality, integrations and responsibilities fit together cleanly. Operationally, automated attack detection helps to separate relevant signals from less critical events more quickly.

See also: EDR, Security Operations Center and Security Orchestration, Automation and Response.