![\"The](\"https:\/\/www.paloaltonetworks.com\/blog\/wp-content\/uploads\/2019\/12\/Top-image.png\")
<\/span><\/div><\/p>\nThere\u2019s been a lot of buzz about XDR as of late \u2013 and not just from us. Analysts, competitors, seemingly everyone is talking about XDR these days. However, in the classic security industry problem of every product sounding basically the same, we are often asked to clarify.\u00a0<\/span><\/p>\n What is XDR? How does it differ from, complement and\/or integrate with endpoint detection and response (EDR), endpoint protection platforms (EPP), network traffic analysis (NTA) or name-your-other-security-tool? What are the key criteria to look for when evaluating an XDR product?<\/span><\/p>\n The short answer is that the \u201cX\u201d in XDR is a variable that stands for \u201canything,\u201d meaning XDR solutions, at their core, are detection and response platforms that can take good data from network sensors, endpoint sensors and cloud sensors, and perform analysis on that data in a central location. Our visionary CTO and co-founder Nir Zuk <\/span>coined this category<\/span><\/a> in 2018, recognizing that the existing detection and response tools on the market were too narrowly focused to serve security teams\u2019 evolving needs. XDR products are designed to detect and stitch together all the available information on any threats that have evaded prevention to provide security analysts with detailed analysis of any attack that is underway. This information allows a security team to react to and resolve incidents quicker, and also allows the team to be more proactive with threat hunting.\u00a0<\/span><\/p>\n
![\"The](\"https:\/\/www.paloaltonetworks.com\/blog\/wp-content\/uploads\/2019\/12\/XSOAR-image.png\")
We truly embrace the principles outlined in this book as we continue to improve upon our own industry-leading XDR product, Cortex XDR. With Cortex XDR, we are able to automate huge chunks of triage, investigation and response processes and give analysts all the information that they need to make informed decisions on the stuff that can\u2019t be automated. We\u2019ve been able to group disparate alerts into \u201cincidents\u201d to reduce the alert load by 50x, and we, on average, speed up the investigation process by 8x. Compared to the old incident response process, which centered around a log collector and a pile of siloed analysis tools, we\u2019ve seen that XDR is dramatically more efficient, effective and scalable.<\/span><\/p>\n