SchildmarkGuide
XDR vs EDR vs SIEM (and MDR): what each one does, and which you need
EDR detects and responds to threats on endpoints. XDR extends detection and response to network, firewall, cloud and Microsoft 365 data in one console, while a SIEM collects logs from almost any source for correlation, search and audits. MDR and a managed SOC are services rather than tools: people who watch the alerts and respond for you.
XDR, EDR, SIEM, MDR: the short definitions
Three are tools you run; the last two are services someone runs for you.
- EDR, endpoint detection and response
- An agent on laptops and servers that records process, file and network activity, detects malicious behaviour and lets you respond on the machine, for example by isolating it or stopping a process. It sees only what happens on endpoints.
- XDR, extended detection and response
- Detection and response across several layers: endpoints plus network sensors, firewalls, cloud accounts, email and identity. Alerts from all of them land in one list with one severity scale, and response reaches beyond the endpoint, for example blocking an address on the firewall.
- SIEM, security information and event management
- A central log platform: it collects events from almost any system, correlates them with rules, keeps them for long periods, and supports search and compliance reporting. Response is usually added with a separate SOAR tool.
- MDR, managed detection and response
- A service: a provider’s analysts monitor your alerts, investigate them and respond, or tell you what to do, often around the clock. It usually comes with the provider’s own tooling.
- Managed SOC, SOC as a service
- An outsourced security operations centre. The scope varies more than the name suggests, from watching a SIEM in office hours to full incident response.
XDR vs EDR vs SIEM vs MDR compared
Simplified on purpose. Products overlap: many XDR products keep logs like a SIEM, and many MDR services run on an XDR.
| EDR | XDR | SIEM | MDR / managed SOC | |
|---|---|---|---|---|
| What it watches | Endpoints | Endpoints, network, firewalls, cloud, Microsoft 365 | Logs from any source you connect | What the provider’s tools cover |
| Response | On the endpoint | On endpoints and beyond, such as the firewall | Alerts; response through SOAR | The provider’s analysts, within the contract |
| Who works the alerts | Your team | Your team, often a small one | Your analysts, with query skills | The provider |
| Typical pricing | Per endpoint | Per endpoint or machine | Often by data volume | Per endpoint or user, people included |
| Main gap | Blind to network and cloud | Depth depends on its integrations | Needs tuning and staff | You depend on the provider’s scope |
MDR vs SIEM: a service, or a platform you staff
The two are often compared, but they answer different questions. A SIEM answers “where are all our logs, and what do they show?” It collects events, keeps them as long as audits require and raises alerts from correlation rules. It does not read those alerts for you: someone has to tune the rules and work the queue.
MDR answers “who is watching, and who acts?” A provider’s analysts monitor your environment, investigate what looks wrong and respond, or tell you what to do, often around the clock. Underneath, an MDR service runs on tools such as EDR, XDR or a SIEM, usually its own.
So the choice comes down to people. With analysts of your own, a SIEM or an XDR gives them the data. Without them, MDR buys the people and the tooling together. In between, a small IT team can run an XDR that explains its alerts in working hours and add MDR or on-call cover for nights. Ask any provider what it actually watches: some MDR services cover endpoints only.
Which one fits which company and team
A rough guide, not a rule. The deciding question is who reads the alerts at three in the morning.
- No IT security staff, a few dozen people
- Endpoint protection plus an MDR service, or an IT service provider that runs detection for you. A tool nobody reads is not protection.
- A small IT team, roughly 50 to 500 people
- An XDR, so one console covers endpoints, firewalls, Microsoft 365 and cloud, with automation and help triaging alerts. Add MDR or on-call cover if nights and weekends must be watched.
- A security team, or heavy regulation
- An XDR for detection and response, plus a SIEM where logs from many more sources must be kept and searched, or your own SOC.
- An MSP or MSSP
- An XDR you can run separately for each customer, responding on the equipment they already own.
A small company without a security team may need MDR, not another tool
That is the honest answer. Every detection tool produces alerts, and someone has to read them, decide and act, at night too. If nobody in the company can, buy the people first: an MDR service, a managed SOC, or an IT service provider that runs the tool for you.
- What Schildmark is
- Software: an XDR across Windows, macOS and Linux endpoints and servers, network sensors, firewalls, Microsoft 365, AWS and Google Cloud, with an AI analyst that explains each alert in plain language and proposes the next step.
- Who runs it
- A small IT team that wants to handle security in working hours with a clear picture, or an MSP or MSSP that runs it for its customers, each in a stack of its own.
- What takes load off
- Response rules that block on your own firewalls, with approval if you want it; verified patching that closes vulnerabilities before they are used; alerts grouped into incidents.
- What it is not
- Not a 24/7 service with our analysts on your alerts, and not an antivirus: you keep your anti-malware, and Schildmark brings Defender for Endpoint or Sophos Central alerts into the same list.
Do you need a SIEM if you have an XDR?
Often not, at mid-size. If your obligations are to detect, respond and show records for a period, an XDR that keeps its logs for as long as you set covers it. NIS2, ISO 27001 controls 8.15 and 8.16, PCI DSS requirement 10 and SOC 2 CC7 ask for logging and monitoring, not for a product called SIEM.
You need a SIEM when you must collect and correlate logs from many systems an XDR does not read, such as in-house applications, or when a security team wants to write its own correlation across all of them. Watch retention either way: PCI DSS 10.5.1, for example, asks for at least 12 months.
Schildmark keeps alerts and events for 7 days to 10 years, as you set, and the compliance page warns when that is shorter than a framework expects. See what it reads on the detection page.
Questions people ask
What is the difference between XDR and EDR?
EDR covers endpoints only: it detects and responds on laptops and servers. XDR adds other sources, such as network sensors, firewalls, cloud accounts and Microsoft 365, puts their alerts in one list with one severity scale, and can respond beyond the endpoint, for example by blocking an attacking address on the firewall.
What is the difference between MDR and SIEM?
A SIEM is a platform: it collects and keeps logs, correlates them with rules and raises alerts, but your own analysts must tune it and work those alerts. MDR is a service: a provider’s analysts watch your alerts, investigate and respond for you, usually on their own tooling, which may include a SIEM or an XDR. The real question is whether you have people to read the alerts.
What is the difference between EDR and SIEM?
EDR is an agent on laptops and servers that detects attacks there and responds on the machine, for example by isolating it. A SIEM collects logs from many sources, EDR included, for correlation, long retention and audits, but does not act on the machine. Many companies feed EDR alerts into a SIEM; for a mid-size company an XDR covers much of both.
Do I need a SIEM if I have an XDR?
Not always. NIS2, ISO 27001, PCI DSS and SOC 2 ask for logging and monitoring, not for a product called SIEM. You need a SIEM when you must collect and correlate logs from many systems the XDR does not read, such as in-house applications, or when a security team wants its own correlation across all of them.
XDR or MDR: which does a small company need?
If nobody in the company can read alerts and act on them, an MDR service or a managed SOC comes first, because a tool does not watch itself. With a small IT team, an XDR that explains its alerts can be enough in working hours, with an MDR service or an on-call arrangement for nights.
Does an XDR replace antivirus?
Not necessarily. Some XDR products include endpoint protection, others do not. Schildmark is not an antivirus: you keep your anti-malware, and Schildmark brings alerts from Microsoft Defender for Endpoint or Sophos Central into the same list as everything else.
Is Schildmark an XDR, a SIEM or an MDR?
An XDR. It collects logs and alerts from endpoints, network sensors, firewalls, Microsoft 365 and cloud accounts, blocks on your firewalls and clouds, explains alerts with an AI analyst and patches with verification. It is software, not a 24/7 managed service; MSPs and MSSPs can run it for their customers.
Not sure which one you need?
Tell us how many machines you run, who looks after IT and what you must prove to whom. We will tell you honestly whether Schildmark fits, or whether a managed service fits better.