SOC, SIEM, MDR, EDR... what are the differences?

SOC stands for Security Operation Center. A SOC focuses on threat monitoring and incident qualification. 

To achieve this, analysts use a tool called a “SIEM”, for Security Information Management System. A SIEM integrates software used to monitor corporate infrastructures. Analysts configure a set of correlation rules according to the recommended security policy to detect possible threats. 

EDR software monitors terminals (computers, tablets, mobile phones, etc.), not the system network. 

To do this, EDR software analyze the uses made of the monitored terminals, in particular through behavioral analysis. This enables the recognition of behaviors that deviate from a norm after a learning phase. EDR software are also capable of monitoring the exploitation of security flaws. 

The advantage of EDR solutions is that they allow companies to protect itself against both known (e.g., a virus) and unknown attacks by analyzing suspicious behaviors. 

NDR software provide extended visibility to SOC teams across the network to detect the behavior of potentially hidden attackers targeting physical, virtual, and cloud infrastructures. It complements the EDR and SIEM tools. 

The NDR approach provides an overview and focuses on the interactions between the different nodes of the network. Obtaining a broader detection context can indeed reveal the full extent of an attack and enable faster and more targeted response actions. 

XDR software help security teams solve threat visibility problems by centralizing, standardizing, and correlating security data from multiple sources. This approach increases detection capabilities compared to specific terminal detection and response tools (EDR). 

For example, XDR provides complete visibility by using network data to monitor vulnerable (unmanaged) endpoints that cannot be seen by EDR tools. 

XDR analyzes data from multiple sources (emails, endpoints, servers, networks, cloud streams...) to validate alerts, reducing false positives and the overall volume of alerts. This correlation of indicators from multiple sources allows XDR to improve the efficiency of security teams. 

The acronym MDR stands for managed detection and response. These solutions are managed by a cybersecurity provider. They are operated by an internal or outsourced SOC and enable end-to-end addressing of cyber threats. 

An analyst can perform remediation when a threat is detected and confirmed through automation, including the use of an orchestration tool (SOAR for Security Orchestration Automation and Response). Depending on an entity's cybersecurity maturity level, it is also entirely possible to automatically apply remediation. 

These solutions allow an acceleration of the processing of alerts.

CSIRT stands for Computer Security Incident Response Team. This team handles the response to incidents. 

The CSIRT teams work in anticipation: they enrich our various threat intelligence tools (Threat Intelligence). They also intervene in emergencies to support companies in managing cyber crises.