What Is XDR? (Extended Detection and Response)

When it comes to detection and response, security operations center (SOC) analysts are faced with a daunting responsibility. They must quickly identify critical threats to limit risk and damage to the organization. 

Investigations are often manual and time-consuming due to abundant logs and unclear indicators. XDR automates threat investigations, providing rich data and tools for analysis, such as automated root cause analysis, which shows attack timelines and paths across various security layers.

It is no surprise that IT and security teams are often overwhelmed with alerts coming from different solutions. A company with an average of 1,000 employees can see a peak of up to 22,000 events per second enter their security information and event management (SIEM) system. That’s almost 2 million events in a day.^[1] They have limited means in which to correlate and prioritize these alerts, and struggle to quickly and effectively weed through the noise for critical events. XDR automatically ties together a series of lower-confidence activities into a higher-confidence event, surfacing fewer and more prioritized alerts for action.

Many security products provide visibility into activity. Each solution offers a specific perspective and collects and provides data as relevant and useful for that function. Integration between security solutions can enable data exchange and consolidation. The value is often limited by the type and depth of the data collected and the level of correlated analysis possible. This means there are gaps in what an analyst can see and do. XDR, by contrast, collects and provides access to a full data lake of activity across individual security tools, including detections, telemetry, metadata, and netflow. Applying sophisticated analytics and threat intelligence, XDR provides the full context needed for an attack-centric view of an entire chain of events across security layers.

Faced with many logs and alerts but no clear indicators, it’s difficult to know what to look for. If you find an issue or threat, it’s hard to map out its path and impact across the organization. Performing an investigation can be a time-consuming, manual effort, if there are even the resources to do it. XDR automates threat investigations by eliminating manual steps and provides rich data and tools for analysis that would otherwise be impossible. Consider, for example, automated root cause analysis. An analyst can clearly see the timeline and attack path that may cross email, endpoints, servers, cloud workloads, and networks. The analyst now can assess each step of the attack to enact the necessary response.

The result of these challenges is that threats go undetected for too long, increasing response time and raising the risk and consequences of an attack. XDR ultimately leads to much-needed improvements in threat detection rates and response times. Increasingly, security organizations are measuring and monitoring mean-time-to-detect (MTTD) and mean-time-to-respond (MTTR) as key performance metrics. Likewise, they evaluate solution value and investments in terms of how they drive these metrics and thus reduce the enterprise’s business risks.