security//XDR

XDR (extended detection and response) is a category of security product that correlates signals across several domains (commonly endpoints, identity, email, network and cloud workloads), and it is used to detect attacks that no single domain sees and to coordinate the investigation and response.

XDR (extended detection and response) is a category of security product that correlates signals across several domains (commonly endpoints, identity, email, network and cloud workloads), and it is used to detect attacks that no single domain sees and to coordinate the investigation and response.

Its value appears when no single event is decisive. A normal login, a harmless-looking process and an allowed outbound connection may become suspicious when they belong to one trajectory. XDR is a product and architecture category, not a magic algorithm or a technology owned by one vendor. Like a SIEM it correlates events, but it is organized around integrated detection and response workflows rather than a general log platform.

Correlation turns scattered footprints into a route.