XDR defined: Giving meaning to extended detection and response

The term "extended detection and response" or XDR was coined back in 2018, but definitions continue to vary significantly. There was no reliable, unbiased explanation for what XDR is and how it differs from a security analytics platform, which has led to confusion and disregard, dismissing it as nothing more than yet another cybersecurity marketing buzzword. 

To help clarify this, Forrester has released research on what XDR is, what XDR isn't, and what clients need to look for when evaluating XDR solutions. This research is a rigorous breakdown of what to expect from XDR solutions based on interviews and survey results from XDR end users and over 40 security vendors. 

Below is an adaptation of a short excerpt of the report that defines XDR and explains its origins. The complete report goes into significantly more depth and includes helpful recommendations. 

What Is Extended Detection And Response (XDR)? 

XDR is emerging due to the value that endpoint detection and response (EDR) brings to incident response and the appetite to pair EDR data with additional telemetry that can't be captured from endpoints alone. Forrester defines XDR as: 

The evolution of EDR, which optimizes threat detection, investigation, response, and hunting in real time. XDR unifies security-relevant endpoint detections with telemetry from security and business tools such as network analysis and visibility (NAV), email security, identity and access management, cloud security, and more. It is a cloud-native platform built on big data infrastructure to provide security teams with flexibility, scalability, and opportunities for automation. 

XDR's value is driven by its security analytics capabilities, third-party integrations, and response actions. 

Why Does XDR Come From EDR? 

EDR was the proof of concept for XDR. EDR's remarkable success served as validation that its detection and response capabilities allow security analysts to detect threats, perform investigations, and respond in real-time. While EDR provides effective endpoint detection and response, security teams require more telemetry than just the endpoint. Security teams have used security analytics platforms, security information and event management (SIEM) solutions, NAV, and homegrown data lakes to match endpoint telemetry with security data from other parts of the environment. These efforts had varying degrees of success but suffered from extreme resource consumption, a high rate of false positives, and sizable data volumes. 

How Is XDR Brought To Market? 

XDR is often categorized as open or closed, which is confusing, as open implies "open source," which is very different than what is meant by "open XDR." Thus, Forrester describes XDR as "native" or "hybrid." 

Forrester defines hybrid XDR as: 

An XDR platform that relies on integrations with third parties for the collection of other forms of telemetry and execution of response actions related to that telemetry. 

Forrester defines native XDR as: 

An XDR suite that integrates with other security tools from their portfolio for the collection of other forms of telemetry and execution of response actions related to that telemetry. 

Is XDR The Same As SIEM? 

XDR is on a collision course with security analytics and security orchestration, automation, and response (SOAR). XDR and SIEM are not converging but colliding. 

XDR will compete head-to-head with security analytics platforms (and SIEMs) for threat detection, investigation, response, and hunting. Security analytics platforms have over a decade of experience in data aggregation they apply to these challenges but have yet to provide incident response capabilities that are sufficient at enterprise scale, forcing enterprises to prioritize alternate solutions. XDR is rising to fill that void through a distinctly different approach anchored in endpoint and optimization. 

The core difference between XDR and the SIEM is that XDR detections remain anchored in endpoint detections, as opposed to taking the nebulous approach of applying security analytics to a large set of data. As XDR evolves, expect the vendor definition of endpoint to evolve as well based on where the attacker target is, regardless of if it takes the form of a laptop, workstation, mobile device, or the cloud. 

This post was written by Analyst Allie Mellen, and it originally appeared here.