XDR – What’s Extended Detection and Response?

Executive Summary

XDR, or extended detection and response, is a unified security incident platform that uses machine learning and, more recently, AI to automate detection and response.

Here’s how it works:

• Incident-Based Investigation and Attack Visibility – XDR collects alerts from different log sources and correlates them into incidents, giving the security analyst a full view of each potential attack.
• Automated Kill Chain and Handling – Using security signals from many different sources and its built-in automation, XDR can detect ongoing attacks and initiate an incident response action.

Extended Detection and Response

XDR is designed to provide a full or holistic view and an efficient way to protect against and respond to advanced cyber attacks. Threat actors today leverage legitimate applications instead of compiling their own programs, so relying on known signatures is impossible. XDR, therefore, improves upon endpoint detection and response (EDR) capabilities and analyzes behavior to find malicious patterns by integrating various security technologies into one unified platform.

Data Integration

XDR connects and collects data from otherwise siloed security solutions, combining them to improve the security analyst’s visibility. It integrates with EDR, network detection and response (NDR), and several other security solutions.

Threat Detection and Response

By collecting alerts and correlating them into incidents, the security analyst gets a full view of the possible cyber attack. This is achieved by using machine learning algorithms, advanced analytics, and AI to monitor several different security solutions.

Automation

When a threat is detected, the built-in automation can take effective incident response actions. For example, a user account can be locked, or a device can be isolated to disrupt the ongoing cyber attack.

Threat Visibility

The visibility is based on the number of alerts ingested from the monitored security solutions. Greater visibility can reduce the time it takes to investigate an incident, meaning that a full cyber attack can be successfully remediated before the impact is significant.

Asset Recovery

XDR can also leverage built-in automation capabilities to return assets compromised by an attack to a safe state.

FAQ