{"id":39714,"date":"2021-02-24T18:00:00","date_gmt":"2021-02-24T18:00:00","guid":{"rendered":"https:\/\/www.darkreading.com\/vulnerabilities---threats\/the-realities-of-extended-detection-and-response-(xdr)-technology-\/a\/d-id\/1340201"},"modified":"2021-02-24T18:00:00","modified_gmt":"2021-02-24T18:00:00","slug":"the-realities-of-extended-detection-and-response-xdr-technology","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/the-realities-of-extended-detection-and-response-xdr-technology\/","title":{"rendered":"The Realities of Extended Detection and Response (XDR) Technology"},"content":{"rendered":"
<\/div>\n
<\/header>\n

While the term XDR has become pervasive, the technology and market remain a work in progress with lots of innovation and market confusion.<\/span><\/p>\n

Given all the hype around extended detection and response (XDR) technology, it’s worth starting this article by defining term XDR itself. XDR is an integrated suite of security products spanning hybrid IT architectures (such as LAN, WAN, infrastructure-as-a-service, data centers, etc.), designed to interoperate and coordinate on threat prevention, detection, and response. XDR unifies control points, security telemetry, analytics, and operations into one enterprise system.<\/p>\n

The “X” in XDR is about moving from discrete to comprehensive threat detection. Rather than identifying security events on endpoints, networks, and in email, XDR promises to gather and correlate all these events across security controls. So, think threat detection across the cyber kill chain or aligned with the MITRE ATT&CK<\/a> framework. The “D” is about data collection, processing, and analytics to detect cyberattacks faster and more accurately than existing systems. Typically, these activities will be cloud-native, taking advantage of massive scale for advanced analytics across months or even years’ worth of data. Finally, the “R” is really tied to automation. XDR promises to remove a lot of security operations busy work by taking automated actions out-of-the-box. Kind of a poor man’s turnkey security orchestration and response (SOAR).<\/p>\n

That’s the marketing take on XDR, but we’ve been talking about tools consolidation for years, well before someone came up with the term XDR. Is XDR real?<\/p>\n

My esteemed colleague Dave Gruber and I just completed a research project on XDR to answer this question and others. Dave is an expert on endpoint detection and response (EDR), while I focus on the security operations center, so we looked at XDR from many angles. Based on our research, XDR is not only real but may also disrupt the industry in 2021. The ESG research affirms this conclusion as:<\/p>\n