An attack often starts with a phishing email, continues with a hijacked identity and ends on a server. Individual protection products each see only part of it. XDR brings these parts together. There is no standardized definition. The term comes from the security vendor market and describes an evolution of Endpoint Detection and Response.
How does XDR work?
- Collect signals: Sensors on endpoints, in the email service, at the identity provider and in cloud applications deliver events to a common platform.
- Correlate: The platform recognizes that a suspicious email, an unusual login and a conspicuous process belong together, and combines the alerts into one incident.
- Investigate: Automated analyses assess files, processes and accounts. Specialists can search the raw data in a targeted way (threat hunting).
- Respond: Countermeasures such as quarantine, isolating a device, terminating a process or blocking a link run automatically or only after approval, depending on the settings.
A widespread example is Microsoft Defender XDR. Microsoft describes it as a unified defense for endpoints, identities, email and applications. Only products that are licensed and set up are correlated. With automatic attack disruption, the platform can contain ongoing attacks on its own when signals are clear. More on this in the entry Microsoft Defender.
XDR, EDR, SIEM and MDR
- EDR monitors endpoints. XDR extends the view to further areas.
- A SIEM collects logs from any source, including firewalls or line-of-business applications, and is suited for long-term analysis and evidence. XDR is usually more closely tied to one vendor's products. The US agency CISA describes how SIEM and XDR data can be queried together in one place. Many organizations combine both.
- MDR (Managed Detection and Response) is not a product but a service: an external team assesses the alerts and responds, often as part of a Security Operations Center.
In practice for SMEs and municipalities
Many smaller organizations already use Microsoft 365 and have licensed parts of an XDR platform without using them fully. First check which components are available and whether all devices, mailboxes and accounts are connected. What matters next is who assesses alerts, also at night and on weekends. An XDR platform without responsible people generates alerts, but not security.
Risks and typical mistakes
- Gaps in coverage: Servers, third-party systems or network devices that are not connected remain invisible.
- Automation without a plan: Automatic responses must be tested and coordinated so that they do not disrupt operations.
- Vendor dependency: Data and rules are often tied to one platform.
- Data protection: The collected events contain personal data. Purpose, retention period and access must be defined, see GDPR.
How TOMORIS relates
EXPERTS Cyber Security implements Microsoft Defender and identity protection, and prepares detection, reporting and response together with your team. The entry threat intelligence provides background on threat information.