Glossary
XDR (extended detection and response)
Also called: Extended detection and response
In one sentence
XDR connects security signals from computers, email, sign-ins and cloud apps so an attack can be seen and stopped as one connected incident instead of scattered alerts.
EDR watches devices. But attacks rarely stay on one device: they often start with a phishing email, move to a stolen sign-in, then land on a laptop. XDR pulls the evidence from all of those places — endpoints, email, identity and cloud apps — into one view and correlates it, so the alerts “phishing email delivered,” “unusual sign-in from overseas” and “suspicious process on a PC” show up as a single story.
In the Microsoft world, Microsoft Defender XDR is the umbrella that combines Defender for Endpoint (or Defender for Business), Defender for Office 365 (email), Defender for Identity and Defender for Cloud Apps. Which pieces you get depends on your licenses; Microsoft 365 Business Premium includes several of them.
Why it matters for a small business: you don't have a security team to stitch clues together by hand. XDR does much of that correlation automatically, and its automated responses — pulling a malicious email out of every inbox, revoking a compromised user's sessions — work at a speed people can't match.
Example: a CPA firm's partner clicks a link in a fake invoice email. XDR ties together the email, the risky sign-in from an unfamiliar location an hour later and a new inbox rule forwarding messages outside the firm. It flags them as one incident, so the account is locked and the rule removed before any client data is sent out.
XDR is a technology, not a service. Someone still needs to watch it — see MDR and SOC.
Related terms
- EDR (endpoint detection and response)EDR is security software on each computer that watches for suspicious behavior, records what happens, and lets defenders stop and isolate an attack in progress.
- MDR (managed detection and response)MDR is a service where a team of security analysts watches your security tools' alerts, investigates them, and takes action to contain threats on your behalf.
- SIEM (security information and event management)A SIEM is a system that collects logs from across your environment in one place, keeps them, and analyzes them to spot and investigate security problems.
- SOC (security operations center)A SOC is a team — in-house or outsourced — whose job is to watch an organization's security alerts, investigate them and respond to attacks.
- Microsoft Defender for BusinessMicrosoft Defender for Business is Microsoft's endpoint security product for organizations of up to 300 users, combining next-generation antivirus with EDR and automated investigation.
- Business email compromise (BEC)Business email compromise is a fraud where criminals impersonate or take over a real business email account to trick staff, clients or vendors into sending money or sensitive information.