EDR — Endpoint Detection and Response
- Software on laptops, servers, and workstations.
- Records process, file, and network activity on the device.
- Detects malicious behaviour and can isolate the host.
Concepts
EDR, MDR, XDR: three letters, one source of confusion.
These acronyms get used loosely and are easy to mix up. The quickest way to keep them straight: EDR is a tool, MDR is a service, and XDR is an approach to joining tools together. This guide unpacks each and shows how they sit around a SIEM.
Definitions
What each one means
MDR — Managed Detection and Response
- A service, not a product: experts watch your tools for you.
- Useful when you lack a 24x7 SOC of your own.
- You are buying people and process, not just software.
XDR — Extended Detection and Response
- Joins endpoint, network, email, and cloud signals.
- Aims for one correlated view instead of separate consoles.
- An approach as much as any single product.
How they relate
- EDR is often a data source feeding the bigger picture.
- XDR tries to correlate EDR with everything else.
- MDR is the human layer that can wrap any of them.
The obvious question
How is this different from a SIEM?
This is where people get stuck, because the categories overlap. A useful way to think about it: a SIEM is broad and source-agnostic — it will ingest almost anything and is strong at long-term storage, compliance, and custom detections. XDR is narrower and more opinionated, focused on tightly correlating a curated set of security signals out of the box.
In practice many SOCs run both: EDR on the endpoints, a SIEM like Splunk as the central backbone, and either an XDR layer or a SOAR tool to tie response together. They are not competitors so much as parts of a stack. For the backbone, see the SIEM architecture guide; for response, see SOAR.
For the analyst
What this means for your day
As an analyst you will likely pivot between consoles: an alert in the SIEM points you to the EDR for endpoint detail, which you correlate back against network and identity data. Knowing which tool answers which question — and not expecting one tool to do everything — is a real day-one skill. The acronym wars matter far less than being able to follow the evidence wherever it lives.