Cyber Defense eMagazine March Edition for 2022

complement SIEMs by analyzing logs and acting. In fact, NTA/NDR is critical to advancing
visibility beyond logs.
As you can see, there’s a lot to protect in a network, and a lot of approaches to protecting it. But rather
than having a dozen or more point solutions (each with its own interface console) to manage, wouldn’t it
be easier, faster, and more efficient to have just one? That’s where XDR / Open XDR comes in.
Definitions of XDR
Initial definitions of XDR – eXtended or Everything Detection and Response – envisioned it as a single
platform that unifies detection and response across the entire security kill chain. The idea is that instead
of manning a dozen or more separate security consoles to monitor and protect the network, XDR unifies
the telemetry from those tools and presents it in a single dashboard. The more advanced products not
only unify the data, but also correlate and analyze it automatically to present a prioritized list of threats
with recommendations about how to neutralize them.
So how does the market define XDR, specifically? That depends on who you ask. According to Rik
Turner, a lead analyst at Omdia who coined the XDR acronym, XDR is “a single, stand-alone solution
that offers integrated threat detection and response capabilities.” To meet Omdia’s criteria to be classified
as a “comprehensive” XDR solution, a product must offer threat detection and response functionality
across endpoints, networks, and cloud computing environments.
Gartner’s definition is similar in that it points to features such as alert and incident correlation, built-in
automation, multiple streams of telemetry, multiple forms of detections (built-in detections), and multiple
methods of response. However, Gartner requires XDR to be achieved through consolidating multiple
proprietary, vendor-specific security products.
Forrester’s definition of XDR requires the platform to be anchored around an EDR. It defines Native XDR
as EDR integrating with a vendor’s own security tools; Hybrid XDR as EDR integrating with third-party
security tools; a SAP (Security Analytics Platform) as a platform without built-in EDR, but with built-in
NAV and SOAR with third-party integrations; and SSA (Standalone Security Analytics) as those platforms
that rely solely on third-party tools for telemetry sources and responses.
Open XDR
Open XDR was initially created by Stellar Cyber with the same features Gartner mentions, except that
not all the security products/components have to be from the same vendor. Instead, the platform is open
and integrates with third-party security tools. Some components are built-in, and others are added
through deep third-party integrations.
The Open XDR moniker was later picked up by vendors who purely rely on a wide ecosystem of thirdparty
tools for telemetry sources and response, but who don’t offer any built-in components.
Cyber Defense eMagazine – March 2022 Edition 54
Copyright © 2022, Cyber Defense Magazine. All rights reserved worldwide.