First things first, many security companies/vendors make these terms up and water them down with marketing fluff to the point where it can be meaningless to try to compare vendor A's XDR solution to vendor B's XDR solution... So lets start by defining what most people are talking about when they talk about eXtended Detection and Response (XDR) and how its different from Endpoint Detection and Response. From my experience most vendors consider EDR to be anything that blocks or logs execution of code on an endpoint. When they talk about "extended" detection and response, they are typically referring to the network aspect of it. For example, logging or blocking DNS, network connections, filtering webpages, ssl inspection, user behavior, etc. Many of these solutions have a fairly robust logging solution, but it isn't universal. Additionally, not all logging is created equally, ease of access, ability to create rules/detection logic are all things that vary drastically by vendor. Lets contrast that with SIEM, which is meant to be a single place to shove all your logs/telemetry into and spit out alerts or something for your analysts to work through. Much of the focus is taking disparate events and being able to group them together, providing context for an analyst to determine if an event is a security incident. Even if XDR solutions provided the ability to correlate/aggregate any type of events/logs (which is in my experience either don't, or are terrible at it), many don't provide mechanisms for custom detection/business logic. I know of no XDR solution that is a drop in replacement for a well established log management/alerting system like Splunk or Elastic. And some of them even are using elastic, solr or splunk as their backend. TL;DR: EDR/XDR != SIEM, no matter how much vendors want to believe/sell you on it. Also, fuck product marketing people. Answer from genmud on reddit.com