Extended Detection & Response (XDR) is a security model that collects telemetry from multiple layers, such as endpoints, identity systems, email, network tools, and cloud services, then correlates it into one investigation and response workflow. Instead of forcing analysts to jump between separate consoles, XDR tries to turn many low-level alerts into a single incident view.
XDR matters because modern attacks usually cross boundaries: a phishing email can lead to stolen credentials, a suspicious login can trigger endpoint activity, and later movement can show up in network or cloud logs. By linking these signals, XDR helps defenders spot patterns sooner and respond with actions like isolating a host, disabling an account, or blocking a malicious file. In practice, XDR is most useful when integrations are strong and detections are well-tuned; otherwise, it can become just another alert source.