A look into Extended Detection and Response – Microsoft Defender 

What is XDR? 

Extended Detection and Response (XDR) is a new industry term to better describe security solutions that protect across the entire attack chain rather than focusing on a single component such as email or endpoint protection.  XDR tools work together to allow for threat prevention, detection, investigation and response in a single integrated toolset. 

Why does XDR matter? 

XDR systems make it easier to detect and respond to threats by consolidating security tools into a unified platform managed through a single pane of glass.  This unlocks exciting new features such as the ability to identify malware in email and immediately scan your endpoints for the file.  This unified approach to security reduces costs by eliminating complex integrations required to make disparate tools work together.  Additionally, for many organizations, an XDR platform provides coverage for security threats that they hadn’t considered or found cost prohibitive otherwise. 

Microsoft Defender XDR  

Microsoft has strong individual threat protection solutions, but the whole is even greater than the sum of the parts.  Including Defender for Endpoints, Defender for Office 365, Defender for Identities, and Defender for Cloud Apps, Microsoft Defender XDR has become a clear leader in the XDR space.  These tools work together in a single security portal to provide end-to-end protection with deep threat hunting capabilities and powerful threat response capabilities.   

You may be thinking that some of these feature's sound like SIEM features and you would be right!  There is definitely overlap in capabilities as Defender XDR ingests and correlates data from multiple sources automatically.  However, a SIEM like Microsoft Sentinel can still have an important place in many organizations by ingesting data from other security tools if you haven’t standardized on Microsoft and by adding automated incident response capabilities.   

How Interlink Can Help? 

Microsoft solutions can be complex to license and implement and Interlink’s experts can help with both!  If you’re exploring security solutions and want to learn more or ready to purchase and wanting to understand the right way to buy and get deployed, the Interlink team is here to help.  Contact us today to learn how your business can implement Defender XDR.  

Want to learn more about Defender solutions? Interlink is working on a Defender blog series covering the basics and some of the Defender Solutions your business can implement. Follow us on LinkedIn to stay up to date. 

Check out the Microsoft Defender Overview - Simplifying Microsoft Security