XDR (extended detection and response) collects and automatically correlates data across multiple security layers – email, endpoint, server, cloud workload, and network. This allows for faster detection of threats and improved investigation and response times through security analysis. 

Capability imperatives 

Multiple security layers beyond the endpoint 

• To perform extended detection and response activities, you need at least two layers, and the more the better; endpoint, email, network, servers, and cloud workload. 
• XDR feeds activity data from multiple layers to a data lake. All applicable information is made available for effective correlation and analysis in the most relevant structure. 
• Pulling from a single vendor’s native security stack prevents vendor/solution proliferation. It also provides for an unmatched depth of integration and interaction between detection, investigation, and response capabilities. 

Purpose-built AI and expert security analytics 

• Collecting data is one benefit of XDR, but applying analytics and intelligence to drive better, faster detection is critical. 
• As collecting telemetry becomes a commodity, security analytics, combined with threat intelligence, drive value that can turn information into insight and action. 
• An analytics engine fed by native, intelligent sensors offers more effective security analytics than can otherwise be achieved on top of third-party products and telemetry. Any given vendor will have a much deeper understanding of their own solutions’ data than a third-party’s data. You can ensure optimized analytical capabilities by giving priority to XDR solutions that are purpose-built for a vendor’s native security stack. 

Single, integrated and automated platform for complete visibility 

• XDR enables more insightful investigations because you can make logical connections from the data provided within a single view. 
• Having a graphical, attack-centric timeline view can provide answers in one place, including: 
• How the user got infected 
• What was the first point of entry 
• What or who else is part of the same attack 
• Where the threat originated 
• How the threat spread 
• How many other users have access to the same threat 
• XDR augments security analysts’ capabilities and streamlines workflows. It optimizes teams’ efforts by speeding up or removing manual steps, and enables views and analyses that can’t be done in media 
• Integration with SIEM and security orchestration, automation and response (SOAR) enables analysts to orchestrate XDR insight with the broader security ecosystem.