XDR, or eXtended Detection and Response, has been gaining a lot of buzz and traction in recent years. XDR promises a comprehensive view of an organization’s security posture and the ability to quickly detect and respond to threats. This multi-part blog series provides an overview and guidance on developing a successful cybersecurity strategy for any organization implementing or planning to implement XDR.

In Part 1, we focused on why organizations need to extend protection beyond the endpoint to stay ahead of adversaries. In Part 2, we look at why Endpoint Detection and Response (EDR) is a foundation and a cornerstone for any XDR strategy an organization plans to implement.

Over the last few years, XDR has emerged as a simpler and more efficient way to deal with the broad array of threats that security teams currently face. It is not necessarily a product that customers buy but a strategy and a new way of managing security.

An XDR platform, in effect, aims to collect and correlate data across a broad array of network and security surfaces, including servers, endpoints, cloud workloads, network intrusion prevention systems, identity and access management products, email, and more. It analyses the data it collects, consolidates multiple alerts into a single incident, combines “weak” signals into detections, and then responds across multiple security tools.

That said, XDR is not a new idea. This is what older technologies, such as SIEM promised but were never able to truly deliver.

Why SIEM Tools Failed To Meet Expectations

SIEM tools are all about ingesting as much data as they can, often driven by compliance use cases rather than security. However, this is the very reason organizations struggle so much with SIEMs. With so much data being generated, it’s hard to sift through everything and find the needle in the haystack.

Why SIEM did not fit the bill revolves around a few key factors. Firstly, SIEM solutions are designed to ingest and aggregate log data from different sources. This data is then difficult to sift through and piece together, especially when trying to find the root cause of an issue. Secondly, some SIEM vendors have added rudimentary analytics functionality to their products, but this is not enough to address concerns accurately. Further, SIEM solutions are focused on analysis after an incident rather than detecting an incident and are often one-directional, without any ability to control or respond. Security teams are often forced to rely on manual intervention when using SIEM solutions, which can lead to errors and delays in addressing issues.

Given these challenges, it’s understandable that SIEM has failed to address modern security threat detection concerns effectively.

This is where XDR solutions come in. XDR is not about collecting as much data as possible. It’s about being strategic and only collecting the data that is most relevant. This way, you can more easily identify patterns and anomalies. Compared to older tools and technologies, XDR provides higher fidelity and confidence and allows security teams to identify and eliminate security vulnerabilities without adding extra tools or more people.

An XDR platform aims to solve the challenges of a SIEM tool by effective detection and response to targeted attacks. This is not to say that SIEM tools are not needed in an enterprise security stack. SIEMs have been and are useful in solving a number of use cases like log management, compliance, data aggregation, and analytics.

How Endpoint Threat Data Is Crucial for XDR

While XDR and SIEM are tangentially related, the new technology has more in common with EDR. In fact, XDR is an evolution of EDR that broadens the scope of detection far beyond endpoints. XDR builds on the threat detection and response capabilities of EDR and extends it across multiple security tools

“Good XDR lives and dies by the foundation of good EDR.”
– Forrester Report: Adapt or Die: XDR Is on a Collision Course with SIEM and SOAR

EDR-based XDR platforms provide security teams with the visibility and analytical capabilities needed to detect and contain advanced attacks. Endpoints are a critical part of any organization’s cybersecurity posture. They are often the first point of entry for attackers and can be used to move laterally through a network.

Endpoint telemetry is, therefore, essential for detecting compromised assets, correlating threat data across domains, and isolating complex attacks. Endpoints can provide visibility into all aspects of an attack, from the initial infiltration to the final data exfiltration. In order to effectively detect and respond to threats, organizations need to have a comprehensive endpoint security solution in place.  Endpoints are also where the majority of the “response” is needed.

XDR data is gathered from a variety of sources, including endpoint devices, network traffic, and user activity. EDR solutions use this data to identify malicious activity, track the progress of an attack, and determine the root cause of an incident. This information is essential for security teams to contain and remediate attacks quickly. And it’s just as important to extend the response across the entire security stack.

A Strong XDR Builds on the Power of Strong EDR

“I want to replicate what is working with EDR to other areas in my organization.” – Cybersecurity & Technology Leader Global Pharmaceuticals

XDR is taking what works currently in organizations with endpoints and extending it to other attack surfaces. It unifies visibility and control across all connected security platforms, which provides context around potential threats that make remediation efforts easier. It also allows security teams to react faster because of the correlation of data from multiple security vectors. With improved triage and automated contextual enrichment, teams can respond more quickly before the scope of the threat broadens. Out-of-the-box integrations and pre-tuned detection mechanisms across multiple different products and platforms help improve productivity, threat detection, and forensics.

SentinelOne’s Singularity XDR lets analysts take advantage of insights from aggregated event information gathered from multiple tools and services and combine it into a single, contextualized ‘incident.’ It also provides customers with a central enforcement and analytics layer point hub for complete enterprise visibility and autonomous prevention, detection, and response, helping organizations address cybersecurity challenges from a unified standpoint.

Parting Thoughts

To get the maximum out of XDR, it needs to be part of a larger strategy to improve security outcomes. XDR is a means to an end, and as part of the XDR journey, organizations should look at what outcomes they want to achieve with XDR. At a macro level, the XDR solution should, at minimum, help to:

• Improve your security efficacy
• Deliver a single plane for your security needs
• Maximize the value of your existing security investments Improve SecOps efficiency
• Deliver measurable outcomes

XDR is the natural progression of EDR, moving beyond the endpoint to the rest of the security infrastructure, including identity and cloud security. XDR can help organizations to improve their detection and response capabilities, but only if it is implemented correctly.

When implementing XDR, organizations should focus on their specific needs and objectives and choose the vendors, products, and services that will best meet those needs. In order to get the benefit from XDR, it’s vital to have a platform that can integrate existing tools to get the benefits early. Only then will they be able to fully leverage the power of XDR. SentinelOne provides that vision and strategy to help organizations deliver on the promise of XDR and protect the whole organization.

If you would like to learn more about SentinelOne Singularity XDR platform, contact us for more information or request a free demo.