XDR

An attack starts with an email, executes on a laptop and then uses a stolen identity to access cloud resources. Each security tool sees only one piece.

XDR stands for Extended Detection and Response. It connects detections across devices, identities, email, and applications into a shared view of an attack. For example, Microsoft Defender XDR combines telemetry from configured Defender products, links a phishing email to malware on a laptop, and can coordinate responses such as isolating that device. Defender XDR coordinates detection and response across its protection services; Sentinel adds broader analysis of Microsoft and third-party data plus automated response workflows.