Scribd Logo
Upload

Welcome to Scribd!

  • Webcast 122460

    Uploaded by

    Tan Do
    4 views9 pages
    This document summarizes a discussion on SIEM, EDR, XDR and MDR technologies. It introduces the speakers and outlines discussion topics including what XDR is and whether it is needed if a company already uses SIEM and EDR. The discussion notes that there is no agreement on what XDR is and whether it is better than EDR or SIEM. It provides takeaways on using XDR and SIEM together, continuing to use logs, and mapping detections across technologies. Finally, it describes how the CardinalOps platform can help maximize value from existing security stacks.

    Original Description:

    Original Title

    webcast-122460

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Report this Document
    This document summarizes a discussion on SIEM, EDR, XDR and MDR technologies. It introduces the speakers and outlines discussion topics including what XDR is and whether it is needed if a company already uses SIEM and EDR. The discussion notes that there is no agreement on what XDR is and whether it is better than EDR or SIEM. It provides takeaways on using XDR and SIEM together, continuing to use logs, and mapping detections across technologies. Finally, it describes how the CardinalOps platform can help maximize value from existing security stacks.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content
    4 views9 pages

    Webcast 122460

    Uploaded by

    Tan Do
    This document summarizes a discussion on SIEM, EDR, XDR and MDR technologies. It introduces the speakers and outlines discussion topics including what XDR is and whether it is needed if a company already uses SIEM and EDR. The discussion notes that there is no agreement on what XDR is and whether it is better than EDR or SIEM. It provides takeaways on using XDR and SIEM together, continuing to use logs, and mapping detections across technologies. Finally, it describes how the CardinalOps platform can help maximize value from existing security stacks.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content
    of 9

    Demystifying SIEM, EDR, XDR & MDR

    Dr. Anton Chuvakin, Security Advisor at Office of the CISO, Google Cloud
    Randy Watkins, CTO, Critical Start

    July 19, 2022


    Sponsored by
    Today’s speakers

    Moderator

    DR. ANTON CHUVAKIN RANDY PHIL


    Security Advisor at Office of WATKINS NERAY
    the CISO, Google Cloud CTO, VP/Cyber Defense Strategy
    Critical Start
    Discussion topics
    1. What is XDR? If I have a SIEM and EDR, do I need XDR?

    2. Is XDR a better EDR or a better SIEM? What data challenges still exist?

    3. Is SIEM still the foundation of a SOC? Should I be sending all my EDR alerts to the SIEM?

    4. Does XDR work in the cloud? How does XDR improve Cloud Detection and Response
    capabilities?

    5. What is Managed XDR? How is it different from MDR?

    6. Does XDR save headcount or operational expenses?

    7. How do I map my MITRE ATT&CK coverage across SIEM, EDR, XDR?


    Discussion: SIEM or EDR? What about XDR?

    • Q: What is XDR? If I have a SIEM and EDR,


    do I need XDR?

    • A: Nobody knows or at least agrees what


    XDR is.

    • Is XDR a better EDR or a better SIEM? What


    data challenges still exist? The answer
    depends on your definition…
    Takeaways
    1. XDR is the combination of EDR and SIEM capabilities (with some SOAR thrown in), but is
    not a silver bullet.
    a. Both are difficult individually, combining them doesn’t make it easier

    2. Next-Gen SOCs may not revolve around a SIEM, but logs are still necessary.
    a. Logs won’t go away, and future cloud security requires more log analysis

    3. As a first step for cloud security monitoring, send cloud telemetry to your existing SIEM.
    4. MITRE ATT&CK has replaced Cyber Kill-Chain as the standard catalog of adversary
    techniques, so mapping detections across SIEM+EDR is essential to understanding
    preparedness.
    5. XDR platforms may streamline investigation, but still require headcount to respond to
    alerts. This can be augmented by MDR services.
    Maximizing value from your existing stack
    with the CardinalOps SaaS platform

    Create
    MITRE ATT&CK
    coverage map
    & health
    metrics

    Identify Continuously
    cost savings audit SIEM/EDR
    from inefficient to identify &
    queries & remediate
    unused or broken, noisy,
    redundant logs or missing
    detections

    Deliver AI-
    powered
    recommendations
    to increase
    ATT&CK coverage
    Learn more:
    CardinalOps.com
    Resources

    • Can You Do a SIEM-less SOC?

    • 2022 Report: The State of SIEM Detection Risk

    • Son of a Breach Podcast with Rated XDR Series

    • “The Future of SIEM with Anton Chuvakin” (SANS Webinar, Archived)

    • CardinalOps platform – 2-minute demo video


    • Come see us at Black Hat (Booth #2710) and the Level Up Party
    • Get your complimentary signed copy of “This Is How They Tell Me the World Ends:
    The Cyberweapons Arms Race” (Wednesday at 4:30pm)
    Q&A
    AI-Powered Detection Engineering

    Thank you!
    info@cardinalops.com

    You might also like