SIEM vs XDR: How Cybersecurity Detection Works

TL;DR

Security follows the formula S = P + D + R: prevention, detection, and response. Detection means feeding logs, events, and network flow data from every security domain into a monitoring engine that correlates, analyzes, and reports. Two core technologies handle this: SIEM systems and XDR, which are complementary rather than either/or choices.

Transcript

Here's a formula for you to remember. S equals P plus D plus R. What does that mean? Security is about prevention, detection and response. Remember the CIA triad I mentioned in the second video of this series? It's about confidentiality, integrity and availability. And I said everything we do in security is about trying to achieve one or more of th... Read More

Key Insights

• Security is captured by the formula S = P + D + R, meaning it is about prevention, detection, and response. The CIA triad (confidentiality, integrity, availability) is the 'what' of security, while this equation is the 'how' of achieving it.
• Identity and access management, endpoint, network, application, and data security are largely prevention controls. Detection and response are the remaining parts of the equation, covered separately because they handle attacks that prevention did not stop.
• Detection works by gathering information from all security domains into a monitoring engine, then performing four functions: monitoring, analyzing, reporting, and threat hunting. These activities are largely carried out by the Security Operations Center, or SOC.
• A SIEM is a Security Information and Event Management system that sits as a layer on top of individual domain consoles. It solves the problem of fragmented, expensive, siloed tools that give no single consistent view of what is happening.
• A SIEM collects logs, alarms and events, and network flow data, then correlates them so a single attack generating alarms across multiple systems appears as one event rather than four, reducing data to a smaller, manageable subset.
• SIEM analysis applies rules based on security policies, assigns alarm priorities as high, medium, or low, and looks for anomalies. User behavior analytics (UBA) uses machine learning to flag activity that does not belong when analysts do not know exactly what to look for.
• XDR (extended detection and response) grew out of EDR (endpoint detection and response). It takes a top-down approach, installing agents on servers, desktops, and laptops to detect and automate response as close to the attack source as possible.
• SIEM and XDR are complementary, not either/or. You can feed endpoint data into a SIEM or forward SIEM information into an XDR, and experienced analysts use both together, aided by federated search capabilities.

Questions & Answers

Q: What does the security formula S = P + D + R mean?

S = P + D + R means security is about prevention, detection, and response. While the CIA triad (confidentiality, integrity, and availability) represents the 'what' of cybersecurity, this equation represents the 'how'. Prevention, detection, and response are the three approaches used to achieve confidentiality, integrity, and availability across all security domains and controls.

Q: How does cybersecurity detection actually work?

Detection works by gathering information from all the security domains, such as identity, endpoint, network, application, and data security, and feeding it into a monitoring engine. From there the process involves monitoring, analyzing, reporting, and a function called threat hunting. These detection functions are largely performed by the Security Operations Center (SOC) using SIEM and XDR technologies.

Q: What is a SIEM and what is its purpose?

A SIEM is a Security Information and Event Management system. Its purpose is to sit as a layer on top of individual domain security consoles rather than operating them independently. It collects logs, alarms, events, and network flow data into a central database, then applies analytics. This solves the problem of expensive, siloed tools that provide no single consistent view of what is happening.

Q: Why does a SIEM correlate security information?

A SIEM correlates information because a single attack might generate alarms across multiple domains and systems. Without correlation, that one attack could appear as four different events or alarms, causing many people to chase the same problem inefficiently. Correlation reduces all that information down to a smaller, more manageable subset so analysts see it as a single event rather than many.

Q: How does a SIEM detect anomalies?

A SIEM detects anomalies by looking for activity that does not fit expected patterns, rather than only matching known indicators of compromise. It uses artificial intelligence, particularly machine learning, which is good at finding patterns humans might miss. A specific technology called user behavior analytics (UBA) flags when a user behaves differently than peers or when events happen at unexpected times.

Q: What is XDR and where did it come from?

XDR stands for extended detection and response. It grew out of endpoint detection and response (EDR). Whereas EDR installed an agent on each system to detect and respond locally, XDR needed a way to report that endpoint information upward for a comprehensive view. XDR takes a top-down approach, automating response as close to the source of the attack as possible.

Q: What is the difference between SIEM and XDR?

SIEM vendors traditionally came from log management or network behavior anomaly detection, taking a bottom-up approach that brings information up before acting. XDR grew from endpoint detection and response, taking a top-down approach that pushes detection and automated response down to servers, desktops, and laptops, acting as close to the attack source as possible rather than centralizing everything first.

Q: Should you choose SIEM or XDR for detection?

SIEM and XDR are not an either/or choice; they are complementary tools. You can feed endpoint information into a SIEM, or forward SIEM information into an XDR, so there are many ways to make them work together. Experienced cybersecurity analysts use both, aided by federated search capabilities, to get a more comprehensive view of detection.

Summary & Key Takeaways

• Security is defined by the formula S = P + D + R: prevention, detection, and response. Prior domains like identity, endpoint, network, application, and data security are mostly about prevention. This video focuses on detection, which feeds information from every domain into monitoring, analysis, reporting, and threat hunting.

• A SIEM layers on top of siloed domain consoles to collect logs, alarms, events, and network flow data. It correlates related alarms into single events, applies policy-based rules, assigns high, medium, and low priorities, and uses machine learning and user behavior analytics to detect anomalies and report trends to the SOC.

• XDR evolved from endpoint detection and response, taking a top-down approach that installs agents on servers, desktops, and laptops to detect and automate response near the attack source. SIEM and XDR are complementary tools; data can flow between them, and analysts use both with federated search.