Anton and The Great XDR Debate, Part 1 | by Anton Chuvakin | Anton on Security | Medium

Here, if you want TL;DR, my position on XDR today is “wait and see” (boring, huh?). Unlike some of my esteemed former colleagues, I don’t really have a horse in the race. First, a very brief bit of history. The origin of the term XDR (Extended Detection and Response) is disputed. Wikipedia (entry, reviewed 8/6/2021) has us believe that Palo Alto invented the term “in 2018.” Josh Zelonis points out that he in fact invented the term. My Googling for its earliest use didn’t yield any revelations. Today, I see several visions of XDR that are somewhat conflicting. So, let me outline them the way I understand them. So, some points of agreement: As a minor aside, somehow I never got to get myself to care deeply about “open” vs “native” XDR. If we don’t agree on what XDR is, this is not the time to debate variations and subspecies of it… And here is my favorite (Really?! No, not really…) list of XDR vs SIEM comparisons, just for fun: There you have it! Not bad for a Friday afternoon? :-) Relat

3 min read Aug 6, 2021 -- I know you may hate me for this, but I‘ve been finally tempted into the Great XDR Debate. Here, if you want TL;DR, my position on XDR today is “wait and see” (boring, huh?). Unlike some of my esteemed former colleagues, I don’t really have a horse in the race. First, a very brief bit of history. The origin of the term XDR (Extended Detection and Response) is disputed. Wikipedia (entry, reviewed 8/6/2021) has us believe that Palo Alto invented the term “in 2018.” Josh Zelonis points out that he in fact invented the term. My Googling for its earliest use didn’t…

related reading

• WhatDR or What Detection Domain Needs Its Own Tools?medium.com
• The Race to $100B: The Palo Alto Networks Storyrakgarg.substack.com
• Defining A Software Supply Chain Security Platform & Exploring New Techniques, Part 2softwareanalyst.substack.com
• The dotted lines between Threat Hunting and Detection Engineering | by Alex Teixeira | Detect FYIdetect.fyi
• EDR Internals for macOS and Linuxoutflank.nl
• Is the SIEM dead? - CPO Magazinecpomagazine.com
• Create custom detection rules in Microsoft Defender XDR - Microsoft Defender XDR | Microsoft Learnlearn.microsoft.com
• What is Detection Engineering and Why do I Need it?cyberseccafe.com
• Build for Detection Engineering, and Alerting Will Improve (Part 3) | by Anton Chuvakin | Anton on Security | Mediummedium.com
• Report: Identity Crisis: The Biggest Prize in Security | A Contrary Research Deep Dive | Contrary Researchresearch.contrary.com
• More on Threat Huntingtaosecurity.blogspot.com
• Lessons learned from EDR Bypass threat hunting | by Cristóbal Martínez | Mediummedium.com