What is XDR?
Extended Detection and Response, told as a story about guards who become one pack.
Lots of guards, and none of them talk.The room dog, the gate guard, the mailroom, the shed outside. Each watches only its own spot.
A burglar passes through many spots.Each piece looks harmless, so nobody barks.
XDR makes the guards one pack.It reaches past the rooms, so everyone knows what everyone saw.
Join the pieces, then move together.Bin the letter, lock the room, shut the gate — all at once.
It doesn't listen to guards outside the pack.Usually only one vendor's guards form the pack. Collecting every note is still the big screen's job.
XDR = the guards of rooms, gate, mailroom and shed as one pack: join the pieces, move together.
Extended Detection and Response: the room dog (EDR) stretched across the whole castle. Where the big screen (SIEM) gathers every note and people write the rules, XDR is guards that talk to each other, with the rules built in.
When grown-ups say it
- Extended
- Past the rooms. The dog watched rooms; now the gate, mailroom and shed too.
- Telemetry
- The guards' diaries. What each one saw, written down and sent to the pack.
- Correlation
- Joining the pieces. Letter, laptop and gate as one story. → the big screen story
- Coordinated response
- Moving together. Bin, lock and shut in one go.
- Native XDR
- One vendor's pack. Only that vendor's guards. They talk well, but outsiders stay out.
- Open XDR
- A pack that takes outsiders. Other vendors' guards can join. Harder to get everyone speaking the same language.
- SIEM
- The big screen. Every note, rules written by people. Used alongside XDR. → the big screen story