SIEM collects and correlates logs, EDR watches and contains endpoints, XDR stretches detection across several layers from one vendor, and MDR is a managed service that supplies the analysts. The first three are tools; MDR is people. This guide shows how they overlap and gives you a way to decide, whether you run a 50-person company or a larger team.
Collects logs from servers, cloud, identity and network; normalises, correlates and stores them; raises alerts and supports search and reporting.
Sees: Whatever you send it
What drives cost: Usually data volume, events or retention; plus the staff time to tune it
Records activity on laptops and servers, detects malicious behaviour, and lets responders isolate a host or kill a process.
Sees: Endpoints
What drives cost: Usually per endpoint
A service: the provider’s analysts monitor your tools (often their own EDR), investigate alerts and take or recommend response actions.
Sees: What the provider is connected to
What drives cost: Usually per endpoint or user, depending on the service scope
Combines telemetry from endpoints plus other layers such as email, identity, cloud or network, usually within one vendor’s product family.
Sees: The layers that vendor integrates
What drives cost: Usually a licence tier per user or endpoint
Runs automated playbooks on alerts: enrich, ticket, block, notify.
Sees: Nothing on its own; it acts on alerts from other tools
What drives cost: Platform licence plus the engineering time to build and maintain playbooks
EDR data is one of the best inputs to a SIEM, and XDR is in effect EDR plus a few more inputs with correlation built in. Many MDR providers run their own EDR or XDR and resell it with analysts attached. The practical question is rarely which acronym is best, but who watches the alerts and what they can see.
For a personalised answer, run the SIEM vs SOAR vs XDR Fit Finder. It takes ten questions about your team, logs and alert volume, and returns what to build first and why.
Read SIEM vs SOAR: the real difference, measure where your operation stands with the SOC Maturity tool, practise writing detections in the Detection Lab, and pick network sensors with the IDS/IPS/NDR Selector.
A SIEM gathers logs from many sources and looks for patterns across them, which makes it good for investigations, retention and compliance. EDR sits on each endpoint and records detailed process and file activity, which makes it good for catching and stopping malware and attacker behaviour on that host. They complement each other: EDR gives deep endpoint detail, and a SIEM puts it next to identity, cloud and network events.
EDR is software. MDR is a service in which an outside team runs detection and response for you, usually on top of an EDR product. Buy EDR if you have people to watch the alerts all day and night; buy MDR if you do not.
XDR (extended detection and response) widens EDR beyond the endpoint by combining signals from layers such as email, identity, cloud and network. Most XDR products work best across one vendor’s own tools. The term is used loosely, so ask any vendor exactly which sources are included.
Often yes, if you must keep logs for a set period, investigate across systems an XDR does not cover, or meet a standard that requires log management. If you only need endpoint detection with someone watching, EDR plus MDR may be enough to start.
Often, when you have no one to watch alerts out of hours. Building a staffed round-the-clock operation takes several people, so a service can be the practical route. Check what the provider actually does: whether it responds or only notifies, and which of your systems it can see.
SOAR automates what happens after an alert fires: collecting context, opening tickets, blocking an address. It needs good alerts to be useful, so it usually comes after SIEM or XDR. Our SIEM vs SOAR article goes deeper.
Make sure you can see what is happening: sensible logging for identity and critical systems, and EDR on every endpoint. Then decide who watches: your own people or an MDR service. Add a SIEM when retention, compliance or cross-system investigation demands it. Use the chooser below to check your own answers.
Definitions reflect common industry usage. Vendors use these terms differently, so confirm exactly which data sources, response actions and hours of coverage any product or service includes before you buy.