{"id":120669,"date":"2020-10-28T09:00:44","date_gmt":"2020-10-28T16:00:44","guid":{"rendered":"https:\/\/www.paloaltonetworks.com\/blog\/?p=120669"},"modified":"2020-10-28T13:24:42","modified_gmt":"2020-10-28T20:24:42","slug":"secops-beyond-traditional-edr","status":"publish","type":"post","link":"https:\/\/www2.paloaltonetworks.com\/blog\/2020\/10\/secops-beyond-traditional-edr\/","title":{"rendered":"Moving Beyond Traditional EDR"},"content":{"rendered":"

An evolution is happening in the cybersecurity industry. Even as our workforce is becoming more and more distributed, our security architecture is unifying into a single security analytics capability for threat detection and response. Extended detection and response (XDR) is <\/span>at the center of this shift<\/span><\/a>, providing centralized visibility across your various security data sources. Security teams who are investing in detection and response tools must consider XDR in their evaluations, as XDR delivers all the capabilities of traditional endpoint detection and response (EDR), but with superior extensibility and analytics to meet the needs of the future.<\/span><\/p>\n

 <\/p>\n

XDR Is an Extension of EDR Capabilities<\/span><\/h2>\n

To tell the story of <\/span>XDR<\/span><\/a>, we must begin with traditional EDR because it is the foundation from which we are extending. EDR capabilities are a critical precursor to an XDR solution because there is no better way to detect an intrusion than by monitoring the actual target environment being attacked, and the telemetry collected by EDR forms the basis of triage and investigation. You simply cannot have a marketable XDR solution if you don\u2019t have best-in-class EDR capabilities. That said, 10-20% of any organization\u2019s laptops and workstations are not under management, so as great as EDR is, it\u2019s only situationally useful. Let\u2019s take a look at how <\/span>XDR improves upon this situation<\/span><\/a>.<\/span><\/p>\n

 <\/p>\n

Cloud Workloads Require a Different Type of Endpoint Monitoring<\/span><\/h2>\n

An endpoint is traditionally understood to be an end user computing device such as a laptop or workstation. Unfortunately, this ignores another important endpoint if we\u2019re to view network communication using the middle-school definition of a line segment, connecting <\/span>two<\/span><\/i> endpoints. As cloud technologies such as <\/span>containers<\/span><\/a> and <\/span>serverless<\/span><\/a> become more prevalent, it\u2019s essential that we be able to monitor these endpoints with the same confidence we have in our end user computing environment. This critical next step toward a full-fledged XDR product enables a unified view across the endpoints within your environment, regardless of system function.<\/span><\/p>\n

 <\/p>\n

Let\u2019s Not Forget How the Network Ties It All Together<\/span><\/h2>\n

Network telemetry serves three critical functions in an XDR environment:\u00a0<\/span><\/p>\n

    \n
  1. Detecting compromise of unmanaged assets.\u00a0<\/span><\/li>\n
  2. Providing application-layer anomaly detection where some attacks may never compromise the system itself.\u00a0<\/span><\/li>\n
  3. Correlating events across systems to enable triage of alerts as a single incident across your environment.\u00a0<\/span><\/li>\n<\/ol>\n

    While the first two objectives are advantages of having a network detection and response (NDR) solution, only by leveraging XDR can you accomplish the third to greatly reduce not only the frequency of alerts but the time to triage and investigate them.<\/span><\/p>\n

     <\/p>\n

    Why Are You Still Shopping for a Traditional EDR Product?<\/span><\/h2>\n

    XDR extends all the benefits you expect from a traditional EDR product by further stitching together telemetry from non-endpoint sources to provide better detection and a bigger picture of what\u2019s going on in your environment for your security operations team. Organizations without XDR invest tons of time and money sending traditional EDR data into their SIEM in an attempt to achieve the same benefits an XDR solution will give you out of the box. Don\u2019t invest in the last generation of endpoint security products with traditional EDR, extend your team by unifying your threat detection capabilities with XDR.<\/span><\/p>\n

     <\/p>\n

    Learn More<\/span><\/h2>\n

    Join us on Dec. 8 at 11 a.m. PT for a webinar with SC Magazine where I\u2019ll discuss the evolution of EDR toward XDR, the challenges it\u2019s solving and how it\u2019s changing SOC operations. Register for <\/span>\u201cMoving Beyond Traditional EDR\u201d<\/span><\/a> today.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

    Traditional EDR lays the foundation for protecting organizations, but addressing today\u2019s security challenges requires the unified view provided by XDR<\/p>\n","protected":false},"author":663,"featured_media":120670,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[6765,6770],"tags":[6737,5804,6735],"coauthors":[7346],"class_list":["post-120669","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-secure-the-enterprise","category-secure-the-future","tag-cortex-xdr","tag-edr","tag-xdr","sec_ops_category-must-read-articles"],"jetpack_featured_media_url":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-content\/uploads\/2020\/10\/Cortex-XDR-Future-EDR-blog-400x300-1.png","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/120669","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/users\/663"}],"replies":[{"embeddable":true,"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/comments?post=120669"}],"version-history":[{"count":5,"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/120669\/revisions"}],"predecessor-version":[{"id":120693,"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/120669\/revisions\/120693"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/media\/120670"}],"wp:attachment":[{"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/media?parent=120669"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/categories?post=120669"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/tags?post=120669"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/coauthors?post=120669"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}