thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Extended Detection and Response (XDR)

A security platform that correlates telemetry across endpoints, network, cloud, identity and email for unified detection and response.

Definition

XDR extends EDR by ingesting and correlating data from multiple control points, grouping related alerts into incidents and providing coordinated response actions. Native XDR uses one vendor's products, while open XDR integrates third-party sources. Examples include Cortex XDR, Microsoft Defender XDR and CrowdStrike Falcon Insight XDR.

Example

An XDR incident linking a phishing email, a malicious process on an endpoint and a firewall-observed C2 connection.

Exam tip

XDR reduces alert volume by stitching alerts into incidents across layers.

Don't confuse it with

Related terms