Analysts must manually stitch together alerts from endpoint, email, network and cloud tools to reconstruct each attack, and incidents are being missed between the tools. Which endpoint security approach best addresses this?
Select an answer to reveal the explanation.
Short Explanation
EDR watches the endpoint really well, but your problem is the gaps between tools. XDR pulls endpoint, email, network and cloud telemetry into one place and connects the dots for you. If you're stitching alerts together by hand, you're doing XDR's job manually.
Full Explanation
Extended detection and response collects telemetry from multiple security layers, typically endpoints, email, network, identity and cloud workloads, and correlates it into unified incidents. Linking a phishing email to the process it launched on an endpoint and to the outbound connection that followed lets analysts see one attack chain rather than separate alerts, which reduces both manual effort and missed incidents. Endpoint detection and response provides deep visibility and response on hosts, such as process trees, file changes and isolation, but on its own it is scoped to endpoints, so the gaps between email, network and cloud tools remain. Signature-based antivirus blocks known malware on workstations, which is a basic layer, but it neither correlates across sources nor provides the investigative telemetry analysts need to reconstruct an attack. A NetFlow collector summarizes who talked to whom and how much, which is useful for traffic analysis, yet graphing volume per interface does not correlate endpoint, email and cloud events into incidents. Exam caveat: extended detection and response builds on endpoint detection and response rather than replacing it, and its value depends on which data sources are actually integrated. Operational check: run a controlled test that sends a benign tagged email, opens its attachment on a test host and generates outbound traffic, then confirm the platform presents those events as one correlated incident.