What do EDR, NDR, XDR and MDR mean in plain words?

EDREDR: endpoint detection and response. Security software installed on each computer that watches what happens on that machine. watches each computer from the inside, NDRNDR: network detection and response. Security monitoring that watches the traffic between devices and raises an alert when one behaves like an attacker. watches the traffic between devices, XDR puts several sources in one console, and MDRMDR: managed detection and response. A service in which an outside team watches your alerts and responds for you. is a team that watches the alerts for you. EDR (endpoint detection and response) is software installed on laptops and servers that sees processes, files and memory on that machine. NDR (network detection and response) is a sensor that sees how devices talk to each other, including printers, cameras and machines where no software can be installed. XDR (extended detection and response) is a platform that combines endpoint, e-mail, identity, cloud and sometimes network signals. MDR (managed detection and response) is not software at all but a service: people who read the alerts around the clock and act. You will also see SIEMSIEM: security information and event management. A system that collects logs from many systems and looks for patterns across them. (security information and event management), which collects logs. NetSenX is an NDR; it works alongside the others and does not replace them.

This answer is part of the guide: NDR vs EDR vs SIEM (and XDR, MDR): how they differ

← All 40 questions on NDR, EDR, SIEM, XDR, MDRAll topics