EDR vs XDR vs MDR Platforms

Endpoint Detection and Response (EDR) is a security technology that continuously monitors endpoint devices (laptops, desktops, servers, mobile devices) for suspicious activity and provides automated response capabilities. EDR emerged to address the limitations of traditional antivirus (AV), which relies on signature-based detection and cannot detect novel or polymorphic malware. EDR solutions collect telemetry from endpoints—process creation, network connections, file system changes, registry modifications—and analyze it using behavioral analytics, machine learning, and threat intelligence to detect indicators of compromise (IOCs) and indicators of attack (IOAs).

An EDR agent is installed on each endpoint. The agent captures system events at the kernel level (e.g., via ETW on Windows, auditd on Linux) and sends them to a central server or cloud platform. The platform correlates events across endpoints, applies detection rules, and generates alerts. Key components include:

Extended Detection and Response (XDR) is a unified security incident detection and response platform that automatically collects and correlates data from multiple security layers—endpoints, network, email, cloud workloads, and identity—to detect and respond to threats more effectively than siloed tools. XDR is the evolution of EDR, expanding visibility beyond endpoints.

XDR integrates data from various sources via native connectors or APIs. It ingests telemetry from:

The XDR platform normalizes this data into a common schema (e.g., OCSF - Open Cybersecurity Schema Framework) and performs cross-layer correlation. For example, a suspicious email attachment (email layer) that downloads a file (endpoint layer) that communicates with a known malicious IP (network layer) is correlated into a single incident. Detection uses a combination of signature-based, behavioral, and machine learning models. Response actions can be orchestrated across layers: isolate the endpoint, block the IP at the firewall, and disable the user account.

Managed Detection and Response (MDR) is a service that provides organizations with a dedicated team of security analysts who monitor, detect, and respond to threats using EDR, XDR, or other security tools. MDR is not a technology but a service model. The provider manages the technology stack, triages alerts, conducts investigations, and performs incident response on behalf of the customer.

MDR providers deploy their own EDR/XDR agents or integrate with existing tools (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint). The provider's Security Operations Center (SOC) analysts monitor alerts 24/7. The process includes:

While EDR/XDR are GUI-heavy, some platforms offer CLI tools. For example, CrowdStrike Falcon:

# Check agent status on Linux
sudo falconctl status

# Check agent version
sudo falconctl -g --version

# Trigger a test detection (simulate malware)
curl -s http://test-crowdstrike.com/trigger

For Microsoft Defender for Endpoint:

# Check service status
Get-Service -Name WinDefend

# Start a quick scan
Start-MpScan -ScanType QuickScan

# View detection history
Get-MpThreatDetection

For XDR, verification often involves checking integration status in the console. For example, Palo Alto Cortex XDR:

# Check agent connectivity
sudo /etc/init.d/cortex-xdr-agent status

# View agent logs
tail -f /var/log/cortex-xdr-agent.log

On the CS0-003 exam, you will be asked to:

A mid-size company with 500 endpoints deploys CrowdStrike Falcon EDR to meet compliance requirements. The IT team of three manages alerts. They configure automatic isolation for any endpoint that triggers a 'Ransomware' detection. One day, an employee clicks a phishing link that downloads a trojan. Falcon detects the process executing with suspicious parent-child relationships and isolates the endpoint within 10 seconds. The IT team investigates, finds no lateral movement, and reimages the endpoint. The key pain point is alert fatigue: the team spends 2 hours daily triaging false positives (e.g., legitimate software updates flagged as suspicious). They tune detection rules by excluding known-good processes and adjusting sensitivity. Performance impact is minimal—agent CPU usage averages 2-5%.

A large enterprise with 10,000 endpoints, 500 servers, and cloud workloads deploys Palo Alto Cortex XDR. They integrate firewall logs from Palo Alto NGFWs, email logs from Office 365, and cloud logs from AWS CloudTrail. A cross-layer correlation rule detects a user who received a phishing email, clicked a link, and then their endpoint made an outbound connection to a known C2 server. The XDR platform creates a single incident with all related alerts. The SOC team uses a playbook that automatically blocks the C2 IP at the firewall, isolates the endpoint, and disables the user's account. The mean time to detect drops from 24 hours to 10 minutes. However, integration complexity is high—ingesting cloud logs required custom API connectors and data normalization.

A small business with 200 endpoints has no in-house security team. They subscribe to an MDR service (e.g., Rapid7 MDR) that deploys its own EDR agent. The MDR provider's SOC monitors alerts 24/7. When a cryptominer is detected on a server, the SOC analyst calls the customer to confirm, then isolates the server and removes the malware. The customer receives a weekly report with metrics. The main challenge is response time: the SLA is 30 minutes for critical incidents, but the customer must approve actions, which can delay response. The business benefits from expert analysis without hiring staff. Cost is $5-10 per endpoint per month.