XDR
Extended Detection and Response: a platform that correlates telemetry across endpoint, identity, email, cloud and network in one place, aiming to detect activity that no single source would reveal and to present it as one incident rather than as scattered alerts. It extends EDR beyond the endpoint, and is examined in CySA+, SC-200 and modern SOC-tooling material.
Why It Matters
In practice the argument for XDR is correlation: an impossible-travel sign-in, a mailbox rule creation and an unusual process on a laptop are each low-priority alone and obviously one intrusion together, and stitching them is exactly the work an analyst does manually across consoles. Where XDR genuinely helps is in reducing that pivoting and in presenting an incident with its related evidence attached. Two honest caveats belong in any answer. Native XDR from a single vendor correlates that vendor's telemetry best, so a heterogeneous estate may find coverage uneven and the promised correlation thinner than advertised -- vendor lock-in is a real architectural consideration, not a slogan. And XDR does not replace a SIEM for long-retention, compliance-driven log storage and custom queries over arbitrary sources; the two coexist in most mature environments. Detection quality still depends on the underlying telemetry being collected. On exams, expect questions distinguishing EDR, XDR and SIEM by scope and purpose.
Practice this topic
Test your knowledge of XDR concepts with exam-style practice questions.
Related Fundamentals terms
CIA Triad
The three core principles of information security: Confidentiality (ensuring data is accessible only to authorized parties), Integrity (ensuring data is accurate and unaltered), and Availability (ensuring systems and data are accessible when needed). The CIA Triad is the foundational model for designing security controls, every security measure addresses one or more of these principles. For example, encryption protects confidentiality, hashing protects integrity, and redundancy protects availability. Some frameworks extend this to include authentication, non-repudiation, and privacy. The CIA Triad is the most fundamental concept in cybersecurity and appears in every certification exam.
Defense in Depth
A layered security strategy that uses multiple independent security controls at different levels to protect information assets, so that if one layer fails, others continue to provide protection. Layers typically include physical security, network security (firewalls, IDS/IPS), host security (EDR, hardening), application security (WAF, input validation), data security (encryption, DLP), and administrative controls (policies, training). This approach originates from military strategy and recognizes that no single control is foolproof. Defense in depth is a guiding principle for security architecture and is a fundamental concept in CISSP, Security+, and CISM certifications.
Threat Intelligence
Evidence-based knowledge about existing or emerging threats that helps organizations make informed security decisions, including indicators of compromise (IOCs), tactics, techniques, and procedures (TTPs), and threat actor profiles. Threat intelligence is categorized into strategic (high-level trends for executives), tactical (TTPs for security teams), operational (specific attack campaigns), and technical (IOCs for automated tools). Sources include open-source feeds (MITRE ATT&CK, AlienVault OTX), commercial feeds, ISACs (Information Sharing and Analysis Centers), and dark web monitoring. Threat intelligence is central to CySA+, CTIA, GCTI, and CISSP Domain 1 certifications.
Patch Management
The process of identifying, acquiring, testing, and installing software updates (patches) to fix security vulnerabilities, bugs, and improve functionality across an organization's IT infrastructure. An effective patch management program includes asset inventory, vulnerability scanning, patch prioritization (using CVSS scores and exploitability data), testing in staging environments, deployment scheduling, and verification. Unpatched systems remain the most exploited attack vector, many major breaches (Equifax, WannaCry) resulted from failure to apply available patches. Patch management is required by PCI DSS, HIPAA, and other compliance frameworks and is tested in Security+, CySA+, and CISSP certifications.
EDR (Endpoint Detection and Response)
A security solution that continuously monitors endpoints (laptops, desktops, servers, mobile devices) to detect, investigate, and respond to cyber threats in real time. EDR goes beyond traditional antivirus by using behavioral analysis, machine learning, and threat intelligence to detect fileless malware, living-off-the-land attacks, and advanced threats. Key capabilities include process monitoring, file integrity monitoring, network connection tracking, automated response actions (isolation, remediation), and forensic investigation tools. Leading EDR platforms include CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne, and Carbon Black. EDR is a core technology for SOC operations and is tested in CySA+, CISSP, and Security+ certifications.
Honeypot
A decoy system or resource designed to attract attackers and study their methods, tools, and techniques while protecting real production systems. Honeypots can be low-interaction (simulating services with limited functionality) or high-interaction (full operating systems that allow deeper attacker engagement). A network of honeypots is called a honeynet. Honeypots serve multiple purposes: early warning of attacks, intelligence gathering on new threats, diverting attackers from real targets, and collecting evidence for legal proceedings. Tools include Cowrie (SSH honeypot), Dionaea (malware capture), and T-Pot (multi-honeypot platform). Honeypots are covered in CEH, CySA+, and CISSP security operations topics.