Learn how cloud-native, cloud-scalable security can unify and transform multiple telemetry sources.
Explore InsightIDRExtended Detection and Response (XDR) is a more comprehensive threat detection and response capability that's now a common offering of most cybersecurity providers. This cloud-native, cloud-scalable security solution can unify and transform multiple telemetry sources. Forrester defines XDR as “the evolution of endpoint detection and response” (EDR).
There is an urgency in the industry to push EDR to be more proactive, encompassing, and prescriptive – with no more perimeter, data is rushing to and from the cloud, and the odds favor threat actors more than ever. XDR promises to find threats earlier and respond/remediate faster. Gartner says XDR is a “detection and incident response tool that natively integrates multiple security products into a cohesive security operations system.”
And, according to Enterprise Strategy Group (ESG), XDR security “can act as a cybersecurity force multiplier, not just the next buzzworthy topic at RSA and Black Hat.” There remains significant debate about exactly what XDR is: A product? Solution? An evolution of security information and event management (SIEM)?
For now, the most helpful thing to call it is a meaningful approach to more efficient, effective detection and response.
XDR works by leveraging advanced analytics to correlate alerts from multiple telemetry sources into actionable threat intelligence that can stop threats earlier in the detection and response process. Let's take a look at the inner-workings of an XDR solution.
XDR should unify the telemetry across remote users, network data, endpoints, cloud - and whatever comes next. With a good XDR approach, analysts have curated detections, comprehensive investigations, detailed and highly correlated threat events, and automated-response recommendations. Analysts can work simpler, smarter, faster, and they’ll always know what to do next.
The right XDR approach is the end of tab-hopping. It provides a single, comprehensive hub that can be expanded without technical limitations. Expect SaaS delivery to facilitate collaboration across the office or around the world. XDR should also relieve security teams of steep analytical requirements, parsing and analyzing alerts for you.
There is a dramatically different signal-to-noise ratio with mature XDR. The right methodology, threat intelligence, and diligence behind the detection library means you can trust detections out-of-the-box. And all your disparate data should be correlated by user, asset, and activity.
Forrester says XDR should include prescriptive-response cybersecurity playbooks that can be executed with one click. You should expect prebuilt workflows for things like endpoint threat containment, user-account suspension, and integration with ticketing systems like Jira and ServiceNow.
Traditional SIEMs were built to consume massive amounts of log data and provide security teams with analytic capabilities. From there, it’s up to you to aggregate relevant security telemetry, correlate findings, validate threats, and remediate.
Now, taking an XDR approach – with cloud SIEM at the core – removes analysis and configuration from the plate of your security operations center (SOC). The focus is on efficiency, accelerating incident response, and creating more space in your day.
Traditional SIEM leaves a lot up to you. However, XDR=SIEM + EDR, all with curation. This means teams have native, relevant, and actionable telemetry, high-fidelity detections, and prescriptive response playbooks.
XDR should go well beyond managing and analyzing SIEM logs. Digital transformation is accelerating and “work anywhere” is the new normal. True XDR platforms meet these new security challenges, identifying threats from an array of telemetry sources and threat feeds.
With a growing volume of data to manage comes a growing number of alerts to investigate. Traditional SIEM solutions typically don’t give analysts the context they need to prioritize those alerts.
This is where XDR truly SOARs. By which we mean it leverages security automation and response (SOAR) practices to automate the weeding out of tons of false positives and enrich the quality of alerts coming in. XDR refines and channels the most effective SIEM and SOAR practices, placing emphasis on advanced telemetry, so that teams can be more proactive versus traditional reactive workflows.
EDR is a crucial factor in a SOC’s methodology – it helps to secure specific endpoints across the network and prevent stolen workstation credentials, lateral movement from threat actors, and other elusive behaviors. Capturing relevant context for alerts is the “special sauce” that extends endpoint security so analysts and experts can act faster.
A capable incident detection and response (IDR) solution should be able to leverage this extended endpoint telemetry to provide out-of-the-box threat detection. Analysts could then act faster because they don’t have to sift through mountains of alerts; they can quickly respond to the alert that ranks as the highest priority.
XDR endpoint solutions don’t stop at basic threat detections. Enhanced Endpoint Telemetry (EET) allows teams to know exactly what triggered a particular detection. They’ll get specific details as to what occurred before and after the incident. And, adding that all important “X” to EDR means teams will also benefit from file integrity monitoring (FIM) that provides more robust context around the users and specific assets involved with a detection.
If you're in the market for an XDR solution, you’re not alone: 83% of organizations are increasing their threat detection and response budgets, 29% admit to "blind spots,” 29% need to decrease time-to-recovery, and 27% want help knowing which threats to prioritize.2
Many vendors promising XDR outcomes are assuming you’ll integrate – and pay for – the many other cybersecurity technologies you’ll need for the complete telemetry set and extended-environment visibility: endpoint agents; network sensors; cloud hookups; user behavior analytics (UBA); log ingestion.
It’s important to understand what’s included and what your team is expected to bring.
So, what is one of the most anticipated outcomes of XDR? A promise to end noisy alerts and deliver high-fidelity detections.
It’s a good idea to ask about the methodology, threat intelligence, and diligence behind the detection library. Try to understand the philosophy and proofs-of-concept. Experience detections firsthand. And finally, learn more by looking at objective third-party analysis or reviews.
Find out what’s automated. Are analysts primed for action? Is guidance embedded? XDR is supposed to take away the monotonous, repetitive work and leave you the interesting work you trained for – and hopefully get you home in time for dinner. External, proactive threat intelligence that goes beyond the perimeter is now the norm in responding to incidents along an increasingly dynamic attack surface.
Managed XDR is a services solution provided by an external cybersecurity vendor. It incorporates all of the benefits of XDR mentioned above, with technology, capabilities, alerts, and responses typically managed by that outside vendor. It takes the stress of managing an extended detection and response program off of the shoulders of the internal security team, and allows the SOC to pivot to other initiatives and areas of concern.
Along with an underlying XDR capability, managed detection and response (MDR) typically includes digital forensics breach response, regular threat hunting, 24x7x365 monitoring, and attacker takedown capabilities. By adding XDR capabilities, security teams no longer have to jump in and out of multiple tools. A managed-services partner should be able to surface only true threats and help you create a remediation plan tailored specifically to the attack and how it’s affecting your organization.
When a SOC partners with an MDR provider well versed in XDR capabilities, that team is ensuring it can continue to innovate to drive the business forward while also receiving alerts with the proper context to prioritize.
Download: ESG Research Report, The Impact of XDR in the Modern SOC
1 Enterprise Strategy Group (ESG), February 2021