What is XDR? Extended Detection and Response Security | Fortinet (2024)

Built upon Endpoint Detection and Response (EDR), Extended Detection and Response (XDR) also known as “cross-layered detection and response”. XDR collects, normalizes, and then correlates data over a variety of security layers, including endpoints, firewalls, email, servers, cloud workloads, and the general network. XDR is a new, alternative approach to traditional detection and incident response, integrating detection and response procedures across multiple environments to reduce the mean time to detect and repair attacks.

Well-designed threats can be hard to detect because they work between security silos, which are multiple security approaches that work in parallel but not necessarily together. Due to their ability to lurk between security silos, they can spread or multiply as time goes by. As a result, they may evade the attention of a security operations center (SOC) and end up causing more damage.

XDR isolates and dissects these threats. It collects then correlates each detection according to individual security layers. Each “layer” represents a different attack surface: endpoints, email, network, servers, and cloud workloads. The specific ways in which an XDR solution protects each attack surface would be outlined in the white paper of your XDR provider.

Managing endpoint activity is essential to figuring out how a threat could have gained a foothold and spread from one endpoint to another. With XDR, you can use endpoint sweeping to search for indicators of compromise (IOCs) and then hunt them using information gathered from indicators of attack (IOAs).

An XDR system can tell you what happened at an endpoint, as well as where a threat came from and how it managed to spread across multiple endpoints. XDRcan then isolate the threat, stop necessary processes, and delete or restore files.

Email is one of the biggest and most often used attack surfaces. This makes it a soft target, and XDR solutions may help limit the risks that come with an email system. Even though email security can also be handled with a managed detection and response (MDR)system, XDR pinpoints email security specifically.

As part of the triage process, XDR can detect email threats and identify accounts that have been compromised. It can also detect users that are frequently attacked, as well as patterns of attack. XDR can investigate who is responsible for the threat getting by security protocols and who else could have received the email in question.

To respond to the attack, XDR can quarantine email, reset accounts, and also block the senders responsible.

Analyzing the network for attacks and attack opportunities is an important step in aggressively tackling security issues. With network analytics, events can be filtered, which helps identify points of vulnerability, such as unmanaged and Internet-of-Things (IoT) devices. Whether threats tend to stem from Google searches, email, or well-orchestrated attacks, network analytics can pinpoint the underlying vulnerability.

XDR can detect the problematic behavior within the network and then investigate details about the threat, including how it communicates and how it travels across the company. This can be done regardless of a threat's position on the network, from an edge services gateway (ESG) to a central server. XDR can then report to administrators information about the scope of the attack, so they can quickly find a solution.

Protecting servers and cloud infrastructure involves steps that, at a high level, are similar to those used to secure endpoints. The threat has to be examined to figure out how it arrived in the network, as well as how it was able to spread.

XDR gives you the ability to isolate threats that are custom-designed to focus on servers, containers, and cloud workloads. XDR then investigates how the threat is affecting the workload and examines how it is propagating across the system. It then isolates the server and stops the necessary processes to contain the threat. Threat isolation is a key component of reducing the mean time to recover from attacks.

For example, if a threat gained access to your cloud network through an IoT endpoint, XDR can ascertain where it came from. You can then address the reasons behind the security breach and use that information to come up with a plan of attack.

XDR can also be an effective addition to a suite of security products because it assists in figuring out how the threat affected the server's workload. If it slowed down processing or corrupted data, XDR can tell you to what extent this happened. Then XDR can stop any processes that could facilitate the threat spread. In a cloud environment that supports a vast array of connection points, stopping processes may prevent large data losses or the complete suspension of crucial segments of your operations.