XDR (extended detection and response) collects and automatically correlates data across multiple security layers – email, endpoint, server, cloud workload, and network. This allows for faster detection of threats and improved investigation and response times through security analysis.
XDR
Stealthy threats evade detection. They hide between security silos and disconnected solution alerts, propagating as time passes. In the meantime, overwhelmed security analysts try to triage and investigate with narrow, disconnected attack viewpoints.
XDR breaks down these silos using a holistic approach to detection and response. XDR collects and correlates detections and deep activity data across multiple security layers – email, endpoint, server, cloud workloads, and network. Automated analysis of this superset of rich data detects threats faster. As a result, security analysts are equipped to do more and take quicker action through investigations.
Learn more about the security layers that can feed into XDR.
SOC challenges
When it comes to detection and response, security operations centre (SOC) analysts are faced with a daunting responsibility. They must quickly identify critical threats to limit risk and damage to the organisation.
Alert overload
It is no surprise that IT and security teams are often overwhelmed with alerts coming from different solutions. A company with an average of 1,000 employees can see a peak of up to 22,000 events per second entre their security information and event management (SIEM) system. That’s almost 2 million events in a day.[1] They have limited means in which to correlate and prioritise these alerts, and struggle to quickly and effectively weed through the noise for critical events. XDR automatically ties together a series of lower-confidence activities into a higher-confidence event, surfacing fewer and more prioritised alerts for action.
Visibility gaps between security solutions
Many security products provide visibility into activity. Each solution offers a specific perspective and collects and provides data as relevant and useful for that function. Integration between security solutions can enable data exchange and consolidation. The value is often limited by the type and depth of the data collected and the level of correlated analysis possible. This means there are gaps in what an analyst can see and do. XDR, by contrast, collects and provides access to a full data lake of activity across individual security tools, including detections, telemetry, metadata, and netflow. Applying sophisticated analytics and threat intelligence, XDR provides the full context needed for an attack-centric view of an entire chain of events across security layers.
Difficulty undertaking investigations
Faced with many logs and alerts but no clear indicators, it’s difficult to know what to look for. If you find an issue or threat, it’s hard to map out its path and impact across the organisation. Performing an investigation can be a time-consuming, manual effort, if there are even the resources to do it. XDR automates threat investigations by eliminating manual steps and provides rich data and tools for analysis that would otherwise be impossible. Consider, for example, automated root cause analysis. An analyst can clearly see the timeline and attack path that may cross email, endpoints, servers, cloud workloads, and networks. The analyst now can assess each step of the attack to enact the necessary response.
Slow detection and response times
The result of these challenges is that threats go undetected for too long, increasing response time and raising the risk and consequences of an attack. XDR ultimately leads to much-needed improvements in threat detection rates and response times. Increasingly, security organisations are measuring and monitoring mean-time-to-detect (MTTD) and mean-time-to-respond (MTTR) as key performance metrics. Likewise, they evaluate solution value and investments in terms of how they drive these metrics and thus reduce the enterprise’s business risks.
XDR vs. EDR
XDR represents the evolution of detection and response beyond the current point-solution, single-vector approach.
Clearly, endpoint detection and response (EDR) has been enormously valuable. However, despite the depth of its capability, EDR is restricted because it can only detect and respond to threats inside managed endpoints. This limits the scope of threats that can be detected as well as the view of who and what is affected. These restrictions ultimately limit response effectiveness within the SOC.
Likewise, network traffic analysis (NTA) tools’ purview is limited to the network and monitored network segments. NTA solutions tend to drive a massive number of logs. The correlation between network alerts and other activity data is critical to make sense and drive value from network alerts.
Augmenting the SIEM
Organisations use SIEMs to collect logs and alerts from multiple solutions. While SIEMs allow companies to bring together a lot of information from multiple places for centralised visibility, they result in an overwhelming number of individual alerts. Those alerts are difficult to sort through and understand what is critical and needs attention. Correlating and connecting all of the information logs to gain a view of the larger context is challenging with just a SIEM solution.
Conversely, XDR collects deep activity data and feeds that information into a data lake for extended sweeping, hunting, and investigation across security layers. Applying AI and expert analytics to the rich data set enables fewer, context-rich alerts, which can be sent to a company’s SIEM solution. XDR doesn’t replace the SIEM, it augments it – reducing the time required by security analysts to assess relevant alerts and logs and decide what needs attention and warrants deeper investigations.
Capability imperatives
Multiple security layers beyond the endpoint
Purpose-built AI and expert security analytics
Single, integrated and automated platform for complete visibility
Related Articles