# What is the difference between NDR, EDR and SIEM?

EDR runs on each endpoint and sees the processes and files on that machine. A SIEM collects logs from many systems and correlates them. NDR watches the traffic between devices, so it also covers devices that cannot run an agent and activity that leaves no log. The three complement each other.

FAQ: [NDR, EDR, SIEM, XDR, MDR](https://netsenx.com/en/faq/tools) · https://netsenx.com/en/faq/what-is-the-difference-between-ndr-edr-and-siem

## Read next

- https://netsenx.com/en/what-is-ndr
- https://netsenx.com/en/blog/2026-09-24_ndr-vs-edr-vs-siem

## Related questions

- [What do EDR, NDR, XDR and MDR mean in plain words?](https://netsenx.com/en/faq/edr-ndr-xdr-mdr-explained-in-plain-words)
- [Does NetSenX replace my EDR or SIEM?](https://netsenx.com/en/faq/does-netsenx-replace-my-edr-or-siem)
- [Do I need NDR if I already have EDR?](https://netsenx.com/en/faq/do-i-need-ndr-if-i-already-have-edr)
- [EDR or NDR: which should a small company buy first?](https://netsenx.com/en/faq/edr-or-ndr-which-should-a-small-company-buy-first)
- [Is antivirus enough for a small business?](https://netsenx.com/en/faq/is-antivirus-enough-for-a-small-business)