What is the difference between NDR, EDR and SIEM?
EDREDR: endpoint detection and response. Security software installed on each computer that watches what happens on that machine. runs on each endpoint and sees the processes and files on that machine. A SIEMSIEM: security information and event management. A system that collects logs from many systems and looks for patterns across them. collects logs from many systems and correlates them. NDRNDR: network detection and response. Security monitoring that watches the traffic between devices and raises an alert when one behaves like an attacker. watches the traffic between devices, so it also covers devices that cannot run an agent and activity that leaves no log. The three complement each other.
This answer is part of the guide: NDR vs EDR vs SIEM (and XDR, MDR): how they differ
Read next
Related questions
Terms used here
- EDR (endpoint detection and response)
- Security software installed on each computer that watches what happens on that machine.
- SIEM (security information and event management)
- A system that collects logs from many systems and looks for patterns across them.
- NDR (network detection and response)
- Security monitoring that watches the traffic between devices and raises an alert when one behaves like an attacker.