What Is XDR?

Extended detection and response (XDR) is cross-layered detection and response. XDR collects and automatically correlates data across multiple security layers – email, endpoint, server, cloud workloads, and network – so threats are detected faster and security analysts improve investigation and response times.


Stealthy threats evade detection. They hide between security silos amid disconnected solution alerts and propagate as time passes. In the meantime, security analysts try to triage and investigate with narrow, disconnected attack viewpoints.

XDR breaks down these silos using a holistic approach to detection and response. XDR collects and correlates detections and deep activity data across multiple security layers – email, endpoint, server, cloud workloads, and network. Automated analysis of this superset of rich data detects threats faster. As a result, security analysts are equipped to do more thorough investigations and take quick action.

Learn more about the security layers that can feed into XDR.

SOC challenges

When it comes to detection and response, security operations center (SOC) analysts are faced with a daunting responsibility. They must quickly identify critical threats to limit risk and damage to the organization amid less-than-ideal circumstances. 

Alert overload

It is no surprise that IT and security teams are often overwhelmed with alerts triggered by different solutions. A company with an average of 1,000 employees can see a peak of up to 22,000 events per second enter their security information and event management (SIEM) system. That’s almost 2 million events in a day.[1] Skilled analysts are confronted with an abundant volume of alerts. They have few means to correlate and prioritize them, and struggle to quickly and effectively weed through the noise for critical events. XDR automatically ties together a series of lower-confidence activities into a higher-confidence event, surfacing fewer, prioritized alerts for action.

Visibility gaps

Many security products provide visibility into alerts and activity. Each product offers a specific perspective and collects and provides data as relevant and useful for that function. Integration between security products can enable data exchange and consolidation. The value is often limited by the type and depth of the data collected and the level of correlated analysis possible. This means there are gaps in what you can see and do. XDR, by contrast, collects and provides access to a full data lake of activity data across individual security tools, including detections, telemetry, metadata, netflow, etc. Applying sophisticated analytics and threat intelligence, XDR supplies the full context needed for an attack-centric view of an entire chain of events across security layers.

Difficulty doing investigations

Faced with many logs and alerts but no clear indicators, it’s difficult to know what to look for. If you find an issue or a threat, it’s hard to map out its path and impact across the organization. Performing an investigation can be a time-consuming, manual effort, if there are even the resources to do it. XDR automates processes by eliminating manual steps and provides rich data and tools for analysis that would otherwise be impossible. Consider, for example, automated root cause analysis. An analyst can clearly see the timeline and attack path that may cross email, endpoints, servers, cloud and network. The analyst can then assess each step of the attack to enact the necessary response.

And ultimately … slow detection and response times

The result of these challenges is that threats go undetected for too long, increasing response time and raising the risk and consequences of an attack. Cross-layered detection and response ultimately leads to much-needed improvements in threat detection rates and response times. Increasingly, security organizations are measuring and monitoring mean-time-to-detect (MTTD) and mean-time-to-respond (MTTR) as key performance metrics. Likewise, they evaluate solution value and investments in terms of how they drive these metrics and thus reduce the enterprise’s business risks.


XDR represents the evolution of detection and response beyond the current point-solution, single-vector approach.

Clearly, endpoint detection and response (EDR) has been enormously valuable. However, despite the depth of its capability, EDR is ultimately restricted because it can only look at managed endpoints. This limits the scope of threats that can be detected as well as the view of who and what is affected, and thus, how best to respond.

Likewise, network traffic analysis (NTA) tools’ purview is limited to the network and monitored network segments. NTA solutions tend to drive a massive number of logs. The correlation between network alerts and other activity data is critical to make sense and drive value from network alerts.

The industry has made great strides in detection and response, but to date has only delivered the capabilities via an individual solution and security layer. As a result, data collection and analysis benefits have remained siloed. XDR evolves detection and response into a consolidated, centralized activity that delivers results greater than the sum of the parts.

Augmenting the SIEM

Organizations use SIEMs to collect logs and alerts from multiple solutions. While SIEMs allow companies to bring together a lot of information from multiple places for centralized visibility, they result in an overwhelming number of individual alerts. Those alerts are difficult to sort through and understand what is critical and needs attention. Correlating and connecting all of the information logs to gain a view of the larger context is challenging with SIEM alone.

Conversely, XDR collects deep activity data and feeds that information into a data lake for cross-layer sweeping, hunting, and investigation. Applying AI and expert analytics to the rich data set enables fewer, context-rich alerts, which can be sent to a company’s SIEM solution. XDR doesn’t replace the SIEM.It augments it, reducing the time required by security analysts to assess relevant alerts and logs and decide what needs attention and warrants deeper investigations.

Capability imperatives

Multiple security layers beyond the endpoint

  • To perform cross-layered detection and response, you need at least two layers, and the more the better: endpoint, email, network, servers, and cloud workloads.
  • XDR broadens the scope of detection and response across more than just endpoints. It extends EDR to important additional activity areas. Email, for example, is critical given it is the number 1 attack source.
  • XDR feeds activity data from multiple layers to a data lake. All applicable information is made available for effective correlation and analysis in the most relevant structure.
  • Pulling from a single vendor’s native security stack prevents vendor/solution proliferation. It also provides for an unmatched depth of integration and interaction between detection, investigation, and response capabilities.

Purpose-built AI and expert security analytics

  • Collecting data is one benefit of XDR, but applying analytics and intelligence to drive better, faster detection is XDR’s end goal.
  • As collecting telemetry becomes a commodity, security analytics, combined with threat intelligence, drive value that can turn information into insight and action.
  • An analytics engine fed by native, intelligent sensors offers more effective security analytics than can otherwise be achieved on top of third-party products and telemetry. Any given vendor will have a much deeper understanding of their own products’ data than a third-party’s data. You can ensure optimized analytical capabilities by giving priority to XDR solutions that are purpose-built for a vendor’s native security stack.

Single, integrated and automated platform for complete visibility

  • XDR enables more insightful investigations because you can make logical connections from the data provided within a single view.
  • Having a graphical, attack-centric timeline view can provide answers in one place, including:

How the user got infected
What the first point of entry was
What or who else is part of the same attack
Where the threat originated
How the threat spread
How many other users have access to the same threat

  • XDR augments security analysts’ capabilities and streamlines workflows. It optimizes teams’ efforts by speeding up or removing manual steps, and enables views and analyses that can’t be done immediately.
  • Integration with SIEM and security orchestration, automation and response (SOAR) enables analysts to orchestrate XDR insight with the broader security ecosystem.

XDR Security Topics

[1] Src: http://content.solarwinds.com/creative/pdf/Whitepapers/estimating_log_generation_white_paper.pdf