How XDR Works

What Is XDR?

Extended Detection and Response (XDR) is a unified cybersecurity solution that collects and analyzes data from multiple sources to prevent, discover, and respond to cyberattacks. It expands on Endpoint Detection and Response (EDR) with additional capabilities for detection and response across a network domain, or even cross-domain, to cohesively protect an organization's entire digital environment, including its network, cloud storage, applications, and endpoints.

Why XDR for Endpoint Security?

Constructing the context of a security incident by identifying root causes and determining how to respond requires a high degree of specialized knowledge, skills, and experience, and people with these capabilities are hard to find. Even with the right talent, enterprise threat analysts are increasingly overwhelmed with manually investigating and escalating security events based on correlated information from a wide variety of security products such as Security Information and Event Management (SIEM) systems, Endpoint Protection Platforms (EPP), and other network and host intrusion detection (IDS) and prevention (IPS) systems.

XDR was developed for more advanced threat detection and response—solutions capable of automatically generating contextual associations between events and recognizing anomaly behavior—to reduce the burden on human analysts. Advanced detection isn't about more alerts but better alerts and automated responses. 

How XDR Works

XDR accomplishes its goal of higher-quality detection, automated analysis, and real-time adjustment to network and endpoint security awareness in a few ways.

XDR doesn't only correlate security event log data but rather stitches together related data, generating detailed logic flows and applying machine learning-based analysis to detect anomalous behavior. 

This analysis produces a "single story," enabling cross-data analysis to increase visibility and discover threat context, such as Tactics, Techniques, and Procedures (TTP) related to a security event.

Secondly, XDR conducts a dynamic analysis of running processes (including the spawning of child processes) to: 

  • Detect rogue malware processes
  • Verify the sanity of critical system files and configuration files
  • Track processes that access, modify, or execute critical system files
  • Inspect memory contents to detect file-less malware

XDR seeks to identify internal threats that may have already bypassed external scans and gained initial access. XDR can detect unknown threats and threats that malware signatures cannot identify. 

XDR tools share threat intelligence information to a centrally managed server that can update security profiles of all endpoints, increasing awareness across the whole network. XDR can also take action by remotely accessing services on endpoints to look for and prevent similar threats.

Basic XDR Functions

  • Signature-based malware identification
  • Host firewall duties
  • Full or partial disk encryption or data segmentation
  • Restrict and monitors USB device usage
  • Permitting or disallowing access to certain applications and URLs

Advanced XDR Functions

  • Stitch together related network, cloud, and endpoint data
  • Generate detailed logic flows of process and user behavior
  • Conduct dynamic analysis of running processes
  • Identify credential misuse
  • Monitor endpoint network connections for anomalous behavior
  • Apply machine learning-based analysis to detect anomalous behavior
  • Analyze the context of processes as they are spawned
  • Verify the sanity of critical system files and configuration files
  • Track which processes are accessing, modifying, or executing critical system files
  • Inspect memory contents to detect file-less malware
  • Share threat intelligence information with a central management system
  • Build real-time threat profiles from shared threat intelligence
  • Push security profile configuration changes to endpoints across the network
  • Remotely quarantine, replace, or delete files from endpoints across the network 
  • Remotely access any endpoint services such as shell, PowerShell, and scripting 

CylanceGUARD for Endpoint Security

As a human-centric subscription-based 24x7x365 Managed Detection and Response service, CylanceGUARD® provides the expertise and support that CISOs need. CylanceGUARD combines the deep expertise embodied by BlackBerry Cybersecurity Services with AI-based Endpoint Protection through CylanceENDPOINT™. In short, CylanceGUARD provides businesses with the people and technology needed to protect the enterprise from the modern threat landscape.
LEARN MORE

Related Resources:

Resource Icon Data Loss Prevention (DLP) Resource Icon Endpoint Security Resource Icon Endpoint Protection Platforms (EPP) Resource Icon Endpoint Detection and Response (EDR) Resource Icon Extended Detection and Response (XDR) Resource Icon Identity and Access Management (IAM) Resource Icon Managed Detection and Response Resource Icon Managed XDR Resource Icon MITRE ATT&CK Framework Resource Icon Mobile Threat Defense (MTD) Resource Icon User and Entity Behavior Analytics (UEBA) Resource Icon Zero Trust Architecture Resource Icon Zero Trust Network Access (ZTNA) Resource Icon Zero Trust Security Resource Icon Security Information and Event Management (SIEM) Resource Icon Secure Access Service Edge (SASE)
More Resources