{"id":1163,"date":"2026-09-11T06:29:46","date_gmt":"2026-09-11T06:29:46","guid":{"rendered":"https:\/\/www.osto.one\/resources\/?p=1163"},"modified":"2026-09-11T06:29:46","modified_gmt":"2026-09-11T06:29:46","slug":"xdr","status":"publish","type":"post","link":"https:\/\/www.osto.one\/resources\/glossary\/xdr\/","title":{"rendered":"XDR"},"content":{"rendered":"\n<!-- =========================================================================\n     OSTO GLOSSARY: XDR (EXTENDED DETECTION AND RESPONSE)\n     Live osto.one glossary stylesheet. Paste into one Custom HTML block. No H1.\n     ========================================================================= -->\n\n<style>\n.og{\n  --navy:#1c267a; --text:#0f1538; --muted:#0f1538; --light:#0f1538;\n  --border:#e7e9f2; --divider:#eceef5; --white:#ffffff;\n\n  --peri-50:#f4f5fd;  --peri-100:#e9ecfa; --peri-200:#cfd5f2; --peri-700:#4a52a8;\n  --sage-50:#f2f8f5;  --sage-100:#e3f0e9; --sage-200:#c3ddce; --sage-700:#3a6f5d;\n  --apri-50:#fdf6f0;  --apri-100:#fbe9dc; --apri-200:#f2cdb2; --apri-700:#a2603a;\n  --plum-50:#f8f3f9;  --plum-100:#f0e6f3; --plum-200:#dcc6e2; --plum-700:#6b4576;\n  --sky-50:#f1f7fb;   --sky-100:#e2eff7;  --sky-200:#bfd9e9;  --sky-700:#2f6a89;\n\n  --shadow:0 6px 22px rgba(15,21,56,.05);\n  --font:'Inter',-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;\n  font-family:var(--font); font-size:17px; line-height:1.75; color:var(--text);\n}\n.og p{margin:0 0 22px}\n.og h2{font-family:var(--font);font-size:clamp(25px,3vw,31px);font-weight:700;line-height:1.25;letter-spacing:-.5px;color:var(--navy);margin:52px 0 8px;scroll-margin-top:92px}\n.og h2::after{content:\"\";display:block;width:46px;height:5px;border-radius:3px;margin:12px 0 18px;background:var(--peri-200)}\n.og h2.c-sage::after{background:var(--sage-200)}\n.og h2.c-apri::after{background:var(--apri-200)}\n.og h2.c-plum::after{background:var(--plum-200)}\n.og h2.c-sky::after{background:var(--sky-200)}\n.og ul,.og ol{padding-left:22px;margin:0 0 24px}\n.og li{margin-bottom:9px}\n.og strong{font-weight:600}\n\n.og .dek{font-size:20px;line-height:1.6;color:var(--muted);margin:0 0 18px}\n.og .tags{margin:0 0 30px;padding:0;list-style:none;display:flex;flex-wrap:wrap;gap:8px}\n.og .tags li{margin:0}\n.og .tag{display:inline-block;font-size:12px;font-weight:600;letter-spacing:.7px;text-transform:uppercase;padding:6px 13px;border-radius:20px}\n.og .t-peri{background:var(--peri-100);color:var(--peri-700)}\n.og .t-sage{background:var(--sage-100);color:var(--sage-700)}\n\n.og .short{background:linear-gradient(135deg,var(--peri-100) 0%,var(--sage-100) 100%);border-radius:22px;padding:28px 32px;margin:0 0 30px}\n.og .short .k{font-size:13px;font-weight:700;letter-spacing:1.4px;text-transform:uppercase;color:var(--peri-700);margin:0 0 10px}\n.og .short p{font-size:19px;line-height:1.65;margin:0;color:var(--text)}\n\n.og .toc{background:var(--peri-50);border-radius:20px;padding:24px 28px;margin:0 0 34px}\n.og .toc .k{font-size:12px;font-weight:700;letter-spacing:1.3px;text-transform:uppercase;color:var(--peri-700);margin:0 0 12px}\n.og .toc ol{margin:0;padding-left:20px;columns:2;column-gap:34px}\n.og .toc li{margin-bottom:8px;break-inside:avoid;font-size:16px}\n.og .toc a{color:var(--navy);text-decoration:none;border-bottom:1px solid rgba(28,38,122,.22)}\n\n.og .callout{border-radius:4px;padding:24px 28px;margin:0 0 30px;background:var(--white);border:2px solid var(--navy)}\n.og .callout .k{font-weight:700;font-size:17px;margin:0 0 8px;color:var(--navy)}\n.og .callout p:last-child{margin-bottom:0}\n.og .callout.c-plum{background:var(--plum-50);border:none;border-radius:20px}\n.og .callout.c-plum .k{color:var(--plum-700)}\n\n.og figure{margin:0 0 30px}\n.og .sx{overflow-x:auto;-webkit-overflow-scrolling:touch;border-radius:20px;background:var(--white);box-shadow:var(--shadow)}\n.og .sx svg{display:block;width:100%;height:auto;min-width:600px}\n.og figcaption{font-size:14px;line-height:1.6;color:var(--muted);margin-top:12px}\n.og .swipe{display:none}\n\n.og table{width:100%;border-collapse:collapse;margin:0 0 28px;font-size:15px;background:var(--white);border-radius:18px;overflow:hidden;box-shadow:var(--shadow)}\n.og th{text-align:left;padding:14px 16px;font-weight:700;font-size:12.5px;letter-spacing:.8px;text-transform:uppercase}\n.og td{border-bottom:1px solid var(--divider);padding:13px 16px;vertical-align:top;line-height:1.6}\n.og tr:last-child td{border-bottom:none}\n.og .h-peri th{background:var(--peri-100);color:var(--peri-700)}\n.og .h-sage th{background:var(--sage-100);color:var(--sage-700)}\n.og .h-plum th{background:var(--plum-100);color:var(--plum-700)}\n\n.og .trio{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:0 0 28px}\n.og .tcard{border-radius:18px;padding:20px 22px}\n.og .tcard .n{font-size:16px;font-weight:700;margin:0 0 4px}\n.og .tcard .g{font-size:13px;font-weight:600;margin:0 0 10px;opacity:.8}\n.og .tcard p{font-size:14px;line-height:1.55;margin:0;color:var(--muted)}\n.og .tcard.a{background:var(--sky-50)}   .og .tcard.a .n,.og .tcard.a .g{color:var(--sky-700)}\n.og .tcard.b{background:var(--sage-50)}  .og .tcard.b .n,.og .tcard.b .g{color:var(--sage-700)}\n.og .tcard.c{background:var(--plum-50)}  .og .tcard.c .n,.og .tcard.c .g{color:var(--plum-700)}\n\n.og .pill{display:inline-block;font-size:11px;font-weight:700;letter-spacing:.8px;text-transform:uppercase;padding:5px 11px;border-radius:20px;white-space:nowrap}\n.og .p-req{background:var(--plum-200);color:#4d2f57}\n.og .p-exp{background:var(--sky-100);color:var(--sky-700)}\n.og .p-imp{background:#eef0f4;color:var(--muted)}\n.og .p-ask{background:var(--apri-100);color:var(--apri-700)}\n.og .p-yes{background:var(--sage-100);color:var(--sage-700)}\n.og .p-no{background:#eef0f4;color:var(--muted)}\n\n.og details{background:var(--white);border-radius:14px;margin:0 0 10px;box-shadow:0 2px 10px rgba(15,21,56,.04)}\n.og summary{cursor:pointer;padding:16px 20px;font-weight:600;font-size:17px;color:var(--navy);list-style:none;display:flex;justify-content:space-between;gap:16px;align-items:flex-start}\n.og summary::-webkit-details-marker{display:none}\n.og summary::after{content:\"+\";font-size:22px;line-height:1;color:var(--peri-700);flex:0 0 auto}\n.og details[open] summary::after{content:\"\\2013\"}\n.og details p{padding:0 20px 18px;margin:0;font-size:16px;line-height:1.7}\n\n.og .related{font-size:15px;color:var(--muted);border-top:1px solid var(--divider);padding-top:22px;margin-top:40px}\n\n@media(max-width:700px){\n  .og{font-size:16px}\n  .og .dek{font-size:18px}\n  .og .short p{font-size:17px}\n  .og .short,.og .toc,.og .callout{padding:22px 20px}\n  .og .toc ol{columns:1}\n  .og .trio{grid-template-columns:1fr}\n  .og .swipe{display:inline;font-weight:600;color:var(--peri-700)}\n  .og table{font-size:14px}\n  .og th,.og td{padding:11px 12px}\n}\n<\/style>\n\n<div class=\"og\">\n\n<p class=\"dek\">XDR is the argument that most attacks are invisible to any single tool. The signals exist. They just sit in five different products that never compare notes.<\/p>\n\n<ul class=\"tags\">\n  <li><span class=\"tag t-peri\">Glossary<\/span><\/li>\n  <li><span class=\"tag t-sage\">Detection<\/span><\/li>\n<\/ul>\n\n<div class=\"short\">\n  <p class=\"k\">The short answer<\/p>\n  <p>XDR stands for extended detection and response. It collects telemetry from endpoint, identity, cloud, network and email, correlates it into a single view, and provides response actions across all of them. The X is the point: it extends <a href=\"https:\/\/www.osto.one\/resources\/glossary\/edr\/\">EDR<\/a> beyond the endpoint so that a chain of individually unremarkable events can be recognised as one attack.<\/p>\n<\/div>\n\n<p>It is also a contested category. Every vendor defines it as roughly the shape of what they already sell, which makes the term harder to evaluate than it should be.<\/p>\n\n<div class=\"toc\">\n  <p class=\"k\">On this page<\/p>\n  <ol>\n    <li><a href=\"#layers\">The five signal layers<\/a><\/li>\n    <li><a href=\"#versus\">XDR, EDR and SIEM<\/a><\/li>\n    <li><a href=\"#native\">Native XDR and open XDR<\/a><\/li>\n    <li><a href=\"#fixes\">What XDR is meant to fix<\/a><\/li>\n    <li><a href=\"#osto\">How Osto delivers XDR<\/a><\/li>\n    <li><a href=\"#faq\">FAQ<\/a><\/li>\n  <\/ol>\n<\/div>\n\n<h2 id=\"layers\">The five signal layers<\/h2>\n\n<figure>\n<div class=\"sx\">\n<svg viewBox=\"0 0 760 214\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" role=\"img\" aria-label=\"Five telemetry layers feeding XDR correlation: endpoint, identity, cloud, network and email.\">\n  <defs><marker id=\"xd\" markerWidth=\"8\" markerHeight=\"8\" refX=\"6.5\" refY=\"4\" orient=\"auto\"><path d=\"M0,0 L8,4 L0,8 z\" fill=\"#4a52a8\"\/><\/marker><\/defs>\n\n  <rect x=\"12\" y=\"16\" width=\"136\" height=\"52\" rx=\"11\" fill=\"#1c267a\"\/>\n  <text x=\"80\" y=\"39\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"11.5\" font-weight=\"700\" fill=\"#ffffff\">Endpoint<\/text>\n  <text x=\"80\" y=\"56\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"9.5\" fill=\"#b9c1e6\">Process, file, device<\/text>\n\n  <rect x=\"160\" y=\"16\" width=\"136\" height=\"52\" rx=\"11\" fill=\"#3f4796\"\/>\n  <text x=\"228\" y=\"39\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"11.5\" font-weight=\"700\" fill=\"#ffffff\">Identity<\/text>\n  <text x=\"228\" y=\"56\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"9.5\" fill=\"#c7cceb\">Login, role, token<\/text>\n\n  <rect x=\"308\" y=\"16\" width=\"136\" height=\"52\" rx=\"11\" fill=\"#6b4576\"\/>\n  <text x=\"376\" y=\"39\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"11.5\" font-weight=\"700\" fill=\"#ffffff\">Cloud<\/text>\n  <text x=\"376\" y=\"56\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"9.5\" fill=\"#e3cbe6\">Config, API, key<\/text>\n\n  <rect x=\"456\" y=\"16\" width=\"136\" height=\"52\" rx=\"11\" fill=\"#a2603a\"\/>\n  <text x=\"524\" y=\"39\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"11.5\" font-weight=\"700\" fill=\"#ffffff\">Network<\/text>\n  <text x=\"524\" y=\"56\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"9.5\" fill=\"#f6ddc9\">Traffic, access, web<\/text>\n\n  <rect x=\"604\" y=\"16\" width=\"144\" height=\"52\" rx=\"11\" fill=\"#3a6f5d\"\/>\n  <text x=\"676\" y=\"39\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"11.5\" font-weight=\"700\" fill=\"#ffffff\">Email<\/text>\n  <text x=\"676\" y=\"56\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"9.5\" fill=\"#c9e5d8\">Sender, payload, link<\/text>\n\n  <line x1=\"80\" y1=\"72\" x2=\"340\" y2=\"96\" stroke=\"#4a52a8\" stroke-width=\"1.6\" marker-end=\"url(#xd)\"\/>\n  <line x1=\"228\" y1=\"72\" x2=\"352\" y2=\"96\" stroke=\"#4a52a8\" stroke-width=\"1.6\" marker-end=\"url(#xd)\"\/>\n  <line x1=\"376\" y1=\"72\" x2=\"378\" y2=\"94\" stroke=\"#4a52a8\" stroke-width=\"1.6\" marker-end=\"url(#xd)\"\/>\n  <line x1=\"524\" y1=\"72\" x2=\"404\" y2=\"96\" stroke=\"#4a52a8\" stroke-width=\"1.6\" marker-end=\"url(#xd)\"\/>\n  <line x1=\"676\" y1=\"72\" x2=\"416\" y2=\"96\" stroke=\"#4a52a8\" stroke-width=\"1.6\" marker-end=\"url(#xd)\"\/>\n\n  <rect x=\"248\" y=\"104\" width=\"264\" height=\"46\" rx=\"12\" fill=\"#cfd5f2\"\/>\n  <text x=\"380\" y=\"132\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"13\" font-weight=\"700\" fill=\"#1c267a\">Correlation and response<\/text>\n\n  <rect x=\"12\" y=\"162\" width=\"736\" height=\"42\" rx=\"13\" fill=\"#e3f0e9\"\/>\n  <text x=\"380\" y=\"188\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"12.5\" font-weight=\"700\" fill=\"#3a6f5d\">A phishing click, a new login from a new country, and a fresh cloud key are three low alerts, or one incident.<\/text>\n<\/svg>\n<\/div>\n<\/figure>\n\n<h2 id=\"versus\" class=\"c-sage\">XDR, EDR and SIEM<\/h2>\n\n<p>These three overlap enough that vendors sell all of them against each other. The honest distinction is about scope and about who does the work.<\/p>\n\n<table class=\"h-sage\">\n  <thead>\n    <tr><th><\/th><th><a href=\"https:\/\/www.osto.one\/resources\/glossary\/edr\/\">EDR<\/a><\/th><th>XDR<\/th><th><a href=\"https:\/\/www.osto.one\/resources\/glossary\/siem\/\">SIEM<\/a><\/th><\/tr>\n  <\/thead>\n  <tbody>\n    <tr><td>Scope<\/td><td>Endpoints only<\/td><td>Endpoint plus identity, cloud, network, email<\/td><td>Anything that emits a log<\/td><\/tr>\n    <tr><td>Correlation<\/td><td>Within one host<\/td><td>Across domains, pre-built by the vendor<\/td><td>Whatever rules you write<\/td><\/tr>\n    <tr><td>Response<\/td><td>On the endpoint<\/td><td>Across the connected layers<\/td><td>Usually none by itself<\/td><\/tr>\n    <tr><td>Setup effort<\/td><td>Deploy an agent<\/td><td>Connect the sources it supports<\/td><td>Ingestion, parsing, tuning, ongoing<\/td><\/tr>\n    <tr><td>Best at<\/td><td>Depth on the host<\/td><td>Speed to a usable answer<\/td><td>Breadth, retention and custom questions<\/td><\/tr>\n  <\/tbody>\n<\/table>\n\n<p>SIEM is not obsolete and this does not replace it. SIEM will ingest anything, which matters for audit retention and for the odd log source nobody anticipated. The newer category trades that breadth for correlation that works on day one instead of after a tuning project.<\/p>\n\n<h2 id=\"native\" class=\"c-plum\">Native XDR and open XDR<\/h2>\n\n<p>This is the actual buying decision, and it is where most evaluations go wrong.<\/p>\n\n<table class=\"h-plum\">\n  <thead>\n    <tr><th><\/th><th>Native<\/th><th>Open<\/th><\/tr>\n  <\/thead>\n  <tbody>\n    <tr><td>Telemetry source<\/td><td>The vendor&#8217;s own modules<\/td><td>Third-party tools via connectors<\/td><\/tr>\n    <tr><td>Data consistency<\/td><td>One schema, designed together<\/td><td>Normalisation of whatever each tool exports<\/td><\/tr>\n    <tr><td>Detection quality<\/td><td>Higher, because the signals were built to be compared<\/td><td>Depends on what each connector exposes<\/td><\/tr>\n    <tr><td>Flexibility<\/td><td>You use the vendor&#8217;s modules<\/td><td>Keep the tools you already have<\/td><\/tr>\n    <tr><td>Failure mode<\/td><td>Lock-in to one stack<\/td><td>Correlation quietly degrades as a connector loses fidelity<\/td><\/tr>\n  <\/tbody>\n<\/table>\n\n<div class=\"callout\">\n  <p class=\"k\">Correlation is only as good as the weakest connector<\/p>\n  <p>The open model sounds like the safer choice because it preserves existing investments. The catch is that a connector only surfaces what the source tool chose to export, which is rarely everything. When a vendor changes an API or drops a field, correlation degrades without anything visibly breaking. The native model avoids that by never leaving one schema, which is the strongest argument for buying detection from the same place you buy the controls.<\/p>\n<\/div>\n\n<h2 id=\"fixes\" class=\"c-sky\">What XDR is meant to fix<\/h2>\n\n<table class=\"h-peri\">\n  <thead>\n    <tr><th>Problem<\/th><th>What it looks like<\/th><\/tr>\n  <\/thead>\n  <tbody>\n    <tr><td>Cross-domain blindness<\/td><td>Each tool sees a minor event. Nobody sees the chain that connects them<\/td><\/tr>\n    <tr><td>Alert volume<\/td><td>Five products each generating alerts, most of which are noise, all needing triage<\/td><\/tr>\n    <tr><td>Swivel-chair investigation<\/td><td>Answering one question requires four consoles and manual timestamp matching<\/td><\/tr>\n    <tr><td>Slow containment<\/td><td>Response means logging into a different tool for each action, at the worst possible moment<\/td><\/tr>\n    <tr><td>Missing context<\/td><td>An endpoint alert with no <a href=\"https:\/\/www.osto.one\/resources\/glossary\/iam\/\">identity<\/a> or cloud context is hard to prioritise honestly<\/td><\/tr>\n    <tr><td>Small teams<\/td><td>The work assumes a staffed security operations function, which most companies do not have<\/td><\/tr>\n  <\/tbody>\n<\/table>\n\n<p>That last row is why the category matters more to a lean team than to a large one. A big organisation can staff its way through fragmentation. A ten-person company cannot, so correlation has to come from the tooling.<\/p>\n\n<h2 id=\"osto\">How Osto delivers XDR<\/h2>\n\n<p>Osto is native XDR by construction rather than by strategy. <a href=\"https:\/\/www.osto.one\/resources\/glossary\/epp\/\">Endpoint<\/a>, <a href=\"https:\/\/www.osto.one\/resources\/glossary\/iam\/\">identity<\/a>, <a href=\"https:\/\/www.osto.one\/resources\/glossary\/ztna\/\">ZTNA<\/a>, <a href=\"https:\/\/www.osto.one\/resources\/glossary\/cspm\/\">cloud posture<\/a>, <a href=\"https:\/\/www.osto.one\/resources\/glossary\/waf\/\">web and API protection<\/a> and email security are all built in one stack, so the telemetry shares a schema before anything reaches the correlation layer. There are no connectors to maintain and no fields lost in translation.<\/p>\n\n<p>The practical result is the scenario in the diagram. A phishing email delivered, a device flagged, a login from an unfamiliar location and a new cloud key created are four low-severity events in four separate products. In one stack they are a single chain with a single timeline, and containment happens in the same place. That correlation also feeds the <a href=\"https:\/\/www.osto.one\/resources\/glossary\/incident-response\/\">incident response<\/a> record, which is what an auditor asks for under <a href=\"https:\/\/www.osto.one\/resources\/glossary\/soc-2\/\">SOC 2<\/a> and what the Detect and Respond functions of <a href=\"https:\/\/www.osto.one\/resources\/glossary\/nist-csf\/\">NIST CSF<\/a> describe.<\/p>\n\n<!-- ============ CTA ============ -->\n<div style=\"background:linear-gradient(135deg,#1c267a 0%,#3f4796 48%,#6b4576 100%);border-radius:22px;padding:38px 34px;margin:40px 0 12px;box-shadow:0 10px 26px rgba(28,38,122,.2);text-align:center;\">\n  <p style=\"display:inline-block;background:rgba(255,255,255,.16);color:#ffffff;font-family:'Inter',-apple-system,sans-serif;font-size:11px;font-weight:700;letter-spacing:1.2px;text-transform:uppercase;padding:6px 14px;border-radius:20px;margin:0 0 16px;\">Platform walkthrough<\/p>\n  <p style=\"color:#ffffff;font-family:'Inter',-apple-system,sans-serif;font-size:26px;line-height:1.3;font-weight:700;letter-spacing:-.4px;margin:0 0 12px;\">Four low alerts, or one incident<\/p>\n  <p style=\"color:#cfd3ea;font-family:'Inter',-apple-system,sans-serif;font-size:16px;line-height:1.65;margin:0 auto 26px;max-width:520px;\">Endpoint, identity, cloud, network and email built in one stack, so correlation happens without connectors to maintain. One owner, one dashboard.<\/p>\n  <a href=\"https:\/\/osto.one\/book-demo\/\" style=\"display:inline-block;background:#ffffff;color:#1c267a;font-family:&#039;Inter&#039;,-apple-system,sans-serif;font-weight:700;font-size:16px;text-decoration:none;border-bottom:none;padding:14px 32px;border-radius:12px;margin:0;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#1c267a;\">Book a demo<\/span><\/a>\n  <p style=\"color:#b3b8d8;font-family:'Inter',-apple-system,sans-serif;font-size:13px;margin:18px 0 0;\">Native correlation, no connectors &middot; Built for lean teams &middot; One platform, everything<\/p>\n<\/div>\n\n\n<h2 id=\"faq\">Frequently asked questions<\/h2>\n\n<details>\n  <summary>What is XDR?<\/summary>\n  <p>Extended detection and response. It gathers telemetry from endpoint, identity, cloud, network and email, correlates it centrally, and offers response actions across those layers. It extends <a href=\"https:\/\/www.osto.one\/resources\/glossary\/edr\/\">EDR<\/a> beyond the single host.<\/p>\n<\/details>\n\n<details>\n  <summary>What is the difference between XDR and EDR?<\/summary>\n  <p>EDR sees one endpoint deeply. XDR sees multiple domains and connects events between them. An attack that starts in email, moves through identity and ends in cloud is only visible as one thing at the XDR layer.<\/p>\n<\/details>\n\n<details>\n  <summary>Does XDR replace SIEM?<\/summary>\n  <p>Not usually. SIEM ingests any log source and holds it for retention and custom queries, which matters for audit. XDR gives correlation that works immediately across a defined set of domains. Many organisations run both, with XDR handling detection and SIEM handling breadth.<\/p>\n<\/details>\n\n<details>\n  <summary>What is the difference between native and open XDR?<\/summary>\n  <p>Native XDR correlates telemetry from a single vendor&#8217;s own modules, so the data shares one schema. Open XDR connects third-party tools, preserving existing investments but depending on what each connector exposes. Native generally detects better, open is more flexible.<\/p>\n<\/details>\n\n<details>\n  <summary>Is it the same as MDR?<\/summary>\n  <p>No. Extended detection and response is technology. MDR, managed detection and response, is a service where an external team operates detection on your behalf. You can buy MDR delivered on top of XDR, and the two terms are frequently blurred in marketing.<\/p>\n<\/details>\n\n<p class=\"related\"><strong>Related glossary terms:<\/strong> <a href=\"https:\/\/www.osto.one\/resources\/glossary\/edr\/\">EDR<\/a> &middot; <a href=\"https:\/\/www.osto.one\/resources\/glossary\/siem\/\">SIEM<\/a> &middot; <a href=\"https:\/\/www.osto.one\/resources\/glossary\/epp\/\">EPP<\/a> &middot; <a href=\"https:\/\/www.osto.one\/resources\/glossary\/incident-response\/\">Incident Response<\/a> &middot; <a href=\"https:\/\/www.osto.one\/resources\/glossary\/iam\/\">IAM<\/a> &middot; <a href=\"https:\/\/www.osto.one\/resources\/glossary\/cspm\/\">CSPM<\/a> &middot; <a href=\"https:\/\/www.osto.one\/resources\/glossary\/ztna\/\">ZTNA<\/a> &middot; <a href=\"https:\/\/www.osto.one\/resources\/glossary\/nist-csf\/\">NIST CSF<\/a><\/p>\n\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>XDR is the argument that most attacks are invisible to any single tool. The signals exist. They just sit in\u2026<\/p>\n","protected":false},"author":8,"featured_media":1164,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[180],"tags":[568,567,569,570],"class_list":["post-1163","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-glossary","tag-extended-detection-and-response","tag-xdr","tag-xdr-vs-edr","tag-xdr-vs-siem"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1163","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=1163"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1163\/revisions"}],"predecessor-version":[{"id":1165,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1163\/revisions\/1165"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/1164"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=1163"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=1163"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=1163"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}