Extended Detection and Response (XDR)

XDR builds on endpoint detection and response (EDR). EDR tooling monitors, detects, and remediates malicious activity on endpoints. XDR tooling also covers activity beyond the endpoints, such as cloud and network, and correlates data from email, cloud, and network activity with endpoint telemetry. Correlating data across these layers speeds up threat detection and remediation.

When an XDR detects an attack that spans several layers, such as an attempt to exfiltrate data through both endpoint and cloud weaknesses, it can trigger a containment response that blocks suspicious activity across those layers and notifies the security operations center. NSA zero trust guidance describes XDR as either supplementing or replacing EDR, and recommends a phased move that retires redundant EDR tools without leaving coverage gaps.

XDR works next to a SIEM rather than in place of one. In the same guidance the XDR sends its analysis and correlation results to the SIEM. Logging guidance from ASD's ACSC and partner agencies recommends forwarding selected, processed logs from a central logging facility to SIEM and XDR solutions, and filtering logs before sending them to limit cost and capacity issues.