What is XDR?
Extended detection and response (XDR) takes the EDR model, which collects telemetry and responds from one console, and extends it beyond endpoints. An XDR platform pulls in data from several security layers, correlates it, and presents related alerts as a single incident with one set of response actions.
Data sources XDR typically correlates
- Endpoints: process, file and network activity from EDR agents on workstations and servers.
- Email: phishing messages, malicious attachments and links, and who received and clicked them.
- Identity: sign-ins, MFA prompts, risky logons and privilege changes in the directory.
- Network: firewall, DNS and traffic data showing connections to suspicious destinations.
- Cloud: activity in cloud applications and cloud-hosted workloads.
Why correlation matters
Consider a typical attack chain: a user receives a phishing email, enters a password on a fake login page, the attacker signs in from another country, then runs malware on a file server. Separate tools would raise four unrelated alerts in four consoles. XDR links them into one story, so the analyst sees the entry point, every affected account and device, and the order of events.
Response can also cross layers in one workflow: remove the phishing email from every mailbox, disable the account or force a password reset, isolate the infected machine and block the malicious domain.
Native and open XDR
Vendors take two broad approaches. Native XDR relies mainly on one vendor's own endpoint, email, identity and cloud products working together. Open or hybrid XDR ingests data from third-party tools the organization already owns. The trade-off is depth of integration against flexibility.
XDR compared with similar terms
| Term | Scope | Main purpose |
|---|---|---|
| EDR | Endpoints only | Detect and respond on individual devices |
| XDR | Endpoints plus email, identity, network and cloud | Correlated detection and response across layers |
| SIEM | Logs from almost any system | Central log collection, correlation, search, retention and compliance reporting |
| MDR | Whatever tools the provider runs | Outsourced analysts who monitor and respond |
XDR and SIEM overlap. A SIEM is broader and more customizable but usually needs more tuning and does not act on its own; XDR focuses on security telemetry with built-in detections and response actions. Larger organizations often run both, and an MDR provider may operate either one on a customer's behalf.
XDR on the CompTIA A+ exam
XDR is on the shared A+ acronym list and is Core 2 security material. Expect recognition questions rather than configuration.
- If a question describes one platform that correlates threats across endpoints, email, cloud and user identities, think XDR.
- If the scope is limited to agents on computers, think EDR.
- If the question stresses collecting logs from all systems for search, retention and compliance, think SIEM.
- If an outside company provides the people doing the monitoring, think MDR.