What is XDR, and is it the same as NDR?
No. XDR (extended detection and response) is a platform that combines signals from several sources in one console, while NDRNDR: network detection and response. Security monitoring that watches the traffic between devices and raises an alert when one behaves like an attacker. (network detection and response) is one of those possible sources. Most XDR products are built around an endpoint agent and add e-mail, identity and cloud logs; some add network data, some do not. The difference matters for devices that cannot run an agent, such as printers, cameras, building systems, machines and appliances: an XDR built only on endpoints does not see them unless network data is fed in. Before you buy, ask which sources the XDR really ingests in your licence, not in the brochure. NetSenX is an NDR: it watches the traffic between devices and raises beaconing, scanning, lateral movement and unusual outbound volume on every plan, Free included. It does not replace an EDREDR: endpoint detection and response. Security software installed on each computer that watches what happens on that machine. or an XDR platform, and from the Business plan its alerts can be exported to the SIEMSIEM: security information and event management. A system that collects logs from many systems and looks for patterns across them. or XDR you already run.
This answer is part of the guide: NDR vs EDR vs SIEM (and XDR, MDR): how they differ
Read next
Related questions
Terms used here
- NDR (network detection and response)
- Security monitoring that watches the traffic between devices and raises an alert when one behaves like an attacker.
- EDR (endpoint detection and response)
- Security software installed on each computer that watches what happens on that machine.
- SIEM (security information and event management)
- A system that collects logs from many systems and looks for patterns across them.