XDR vocabulary is crowded and vendors use words loosely. This glossary gives plain definitions of the terms most often confused, so you can ask precise questions: what is the source, what is joined, who acts and what happens to the data.
Core ideas
XDR (extended detection and response). A label for tools that collect security data from several sources and join it into incidents. There is no single standard definition, so ask which sources and which joins.
Telemetry. The raw records a source produces: a process started, a user signed in, a file was shared. More telemetry is not always better. What matters is whether it carries the fields an investigator needs.
Source or data source. A system that supplies telemetry, such as endpoint agents, identity provider, email, network devices, cloud logs.
Correlation. Linking events from different sources that belong to one story, for example a sign in from a new place followed by a mailbox rule and a file download. It is the main promise of XDR.
Incident. A group of related alerts treated as one case. Distinct from an alert, which is a single signal.
Detection. A rule or model that decides an event is suspicious. Many detections describe attacker behavior in the vocabulary of MITRE ATT&CK, a free knowledge base of adversary tactics and techniques.
Response action. Something the tool can do: isolate a device, disable an account, remove an email. Check approvals and logging for each.
Kinds of XDR
Native XDR. Built around one vendor's own products. Correlation tends to work well inside that family and less outside it.
Open or hybrid XDR. Designed to take data from many vendors' tools. Breadth is wider, but depth per source varies and integrations need upkeep.
Neighbouring terms
EDR (endpoint detection and response). Watches endpoints such as laptops and servers. Often the first source for XDR.
SIEM. Collects and stores logs from many systems, searches them and raises alerts by rules. Stronger for retention and audits. Some XDR products overlap with it.
SOAR. Automates response steps through playbooks. XDR often includes lightweight automation of its own.
MDR (managed detection and response). A service in which a provider monitors and responds for you.
MXDR (managed XDR). An MDR service built on an XDR platform. The people are the service. The platform is the tool.
NDR and ITDR. Network detection and response, and identity threat detection and response. Each is a specialty source that XDR may include or integrate.
Terms used in trials and contracts
Coverage. The share of expected sources and devices actually connected. Ask for the number, not the claim.
Field depth. How many useful attributes arrive per event. A sign in with no device or location is thin.
Retention. How long data stays searchable. It differs between hot search and archive.
Benign rate. The share of incidents closed as harmless. Falling over time suggests tuning is working.
Mean time to detect and respond. Averages of how long each step takes. Extreme cases skew them, so ask for distributions.
Quick comparison
| Term | One line |
|---|---|
| XDR | Joins signals from several sources |
| EDR | Endpoint focus |
| SIEM | Log collection, search, rules |
| SOAR | Automated playbooks |
| MDR | Outsourced monitoring and response |
| MXDR | MDR using an XDR platform |
How do you use this glossary in a vendor call?
Pick four terms and ask the vendor to define each in their own words: correlation, source, response action and coverage. Then ask for an example from a real customer scenario, anonymized, showing a chain of events joined into one incident. Compare answers across vendors. Where definitions differ, write the difference down, because it often explains why prices and features do not line up. Keep the notes with your trial results.
Where Safeguard fits
XDR is outside Safeguard's scope, and Safeguard does not replace it. Safeguard focuses on the application and software supply chain side: reachability analysis, policies and gates enforced at build, CI and release, and compliance evidence automation.
What to do
- Write a one line definition of each term as your team will use it.
- Ask vendors to name the sources and joins behind their XDR claim.
- Request numbers for coverage and field depth in a trial.
- Clarify who acts: your people, a service, or automation.
- Check export of rules and history before signing.
Quick check
What is the difference between MDR and MXDR?
MDR is a monitoring and response service. MXDR is that service delivered on an XDR platform. In both, people provide the service and the platform is the tool.
Is native XDR better than open XDR?
Neither is better in general. Native tends to correlate well within one vendor's products, and open tends to cover more vendors with varying depth. Test with your own sources.
Sources
- NIST SP 800-137, Information Security Continuous Monitoring
- NIST SP 800-61 Rev. 3, Incident Response Recommendations
- MITRE ATT&CK
Last reviewed: 18 October 2026.
