Simplifying SIEM, EDR, XDR and SOAR

Issue 7 2022 Editor's Choice, Information Security

There is much hype around the SIEM, EDR, XDR and SOAR acronyms in the market today, and I think the frustration for most large enterprises is the contradictory information you find when searching for an explanation on the Internet. It is like trying to diagnose your own medical condition and getting scared out of your wits with the different ailments Google says you may have.

It’s ironic that when you search for these acronyms you get overloaded with information. You have to delve into it and try to make sense of it. Similarly, it is interesting that these acronyms exist because they have the data overload of cybersecurity events in common.

I have done my own investigation and have realised that many opinions are published based on a vendor, manufacturer or service provider furthering their own agenda. I believe a neutral perspective should be offered.

Why are these solutions important today? The best way to answer this is to go back 25 to 30 years. We hardly heard about an enterprise breach back then. When we did hear about an event it was big news. Today, it can still be big news, but it happens so regularly we have become immune to it.

There is an exponential rise in threats every year. Years ago it was a ‘script-kiddy’ wanting to prove he or she could gain access into an enterprise or government network. Today we are dealing with high-stakes, organised criminal activities by different types of bad actors with differing objectives. It is big business.

We also have to include ‘nation state’ attacks into the mix as there are countries that are providing funds to create cyber weapons. Some argue it is for defence reasons, but in war there is always collateral damage. This can be you or your organisation. Make no mistake, cyber war is happening all around us.

What is concerning is that there are more focused bad actors than there are focused defenders of our cyber environments. Attackers often use the very same tools initially designed to assess and defend our organisations’ environments for their malicious or criminal intentions. Enterprises use machine learning (ML) or artificial intelligence (AI) for defence, but bad actors are building the same capabilities into their attack tools. This, in turn, increases the complexity and the number of threats an enterprise is exposed to.

These are some of the cybersecurity challenges organisations experience today:

• Finding sufficiently skilled persons to defend or protect their environment.

• Log and alert overload giving rise to ‘alert fatigue’.

• The more stealthy threats may fly under the security team’s radar.

• Investigations take long, which takes up costly and scarce human resources.

• Disparate teams don’t always connect the dots when required.

• Too many false positives.

• Slow response to a threat, if any.

• Unnecessary compromise and business downtime.

What can organisations implement to help with these challenges?

• Add more skilled staff resources and more training.

• Correlate the detection of threats.

• Ensure faster analysis of events.

• Introduce better visibility in order to detect, identify and remediate threats faster.

• Identify stealthy threats automatically with machine learning.

• Automate detection, response and remediation.

Employing more staff may be possible for some organisations, but it has cost implications and there is the lack of available and qualified skills to consider. Automation is an option, hence the rise of SIEM, EDR, XDR and SOAR. There are more variations, but let’s keep it simple.

A neutral explanation of what each are:

• SIEM (Security Information and Event Management) has been around the longest. SIEM ingests data from multiple sources, helps correlate events and automates reporting in order for a human operator to analyse the result and make the next decision.

• EDR (Endpoint Detection and Response) is one of the first iterations of the era of automated response that you see in XDR and SOAR today. The endpoints are monitored for threats, threats are correlated and there is an automated response to a threat which may include remediation.

• XDR (Extended Detection and Response) we see as an extension or ‘extended’ detection and response where more data sources than just the endpoints are monitored and used for detection, response and remediation. These data sources can include SIEM, next-generation firewalls, endpoints and more.

• SOAR (Security Orchestration, Automation and Response) has much of the XDR functionality, but adds the automation of other security management processes like vulnerability management and playbooks into the solution in order to reduce the load on the security teams.

There are many conflicting definitions when researching these solutions. Many vendors like to refer to these solutions as software-as-a-service (SaaS), and this may be true in many instances, but it is possible to install comparative on-premises solutions or get the service from a managed service provider. There are obviously pros and cons to consider, dependent on your organisation’s requirements.

Organisations should carefully investigate what approach to take. It is worthwhile to consider the following:

• There will be a substantial cost to each solution, so investigate the differences between on-premises, SaaS or a managed service carefully over the long term.

• These are not ‘configure and leave’ solutions. Continuous improvement is required to manage them.

• Skilled people are still required to manage these solutions, whether you hire them or contract in a service provider.

• From a business perspective, the solutions should prevent attacks or a breach without business disruption or downtime.

• The intention is that critical applications, assets, personally identifiable information (PII) and organisational reputation are protected and maintained.

I hope that this short summary helps you make sense of the different solutions and their acronyms. Perhaps this can help you make a more informed decision about your cybersecurity defence systems.


Credit(s)




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Continuous security optimisation.
News & Events Information Security
Cymulate has announced its partnership with SentinelOne, a threat exposure validation and AI-powered cybersecurity platform. The collaboration delivers self-healing endpoint security that empowers businesses to increase protection for every endpoint on their network.

Read more...
Protect your smart home devices
Kaspersky IoT & Automation Information Security Smart Home Automation
Voice assistants, kitchen robots, smart lights and many other intelligent devices have become part of our everyday life. However, with the rise of smart technology comes the need for robust protection against potential vulnerabilities.

Read more...
ISPA’s take-down process protects from local scams
News & Events Information Security
During the recent school holidays, parents could rest a little easier knowing that ISPA, SA’s official internet industry representative body, is removing an average of three to four problematic websites from the local internet every week.

Read more...
SA’s strained, loadshedding-prone grid faces cyberthreats
Power Management Information Security
South Africa’s energy sector, already battered by decades of underinvestment and loadshedding, faces another escalating crisis; a wave of cyberthreats that could turn disruptions into catastrophic failures. Attacks are already happening internationally.

Read more...
Almost 50% of companies choose to pay the ransom
News & Events Information Security
This year’s Sophos State of Ransomware 2025 report found that nearly 50% of companies paid the ransom to get their data back, the second-highest rate of ransom payment for ransom demands in six years.

Read more...
Winners of the 2025 Southern Africa OSPAs
Editor's Choice
The winners of the 2025 Southern Africa Outstanding Security Performance Awards (OSPAs) were revealed on Wednesday, 4th June, at Securex South Africa. Winners from all categories (except the Lifetime Achievement) will be featured in the second Global OSPAs set to take place in 2026.

Read more...
Deepfakes and digital trust
Editor's Choice
By securing the video right from the specific camera that captured it, there is no need to prove the chain of custody for the video, you can verify the authenticity at every step.

Read more...
A new generational framework
Editor's Choice Training & Education
Beyond Generation X, and Millennials, Dr Chris Blair discusses the seven decades of technological evolution and the generations they defined, from the 1960’s Mainframe Cohort, to the 2020’s AI Navigators.

Read more...
Back-up securely and restore in seconds
Betatrac Telematic Solutions Editor's Choice Information Security Infrastructure
Betatrac has a solution that enables companies to back-up up to 8 TB of data onto a device and restore it in 30 seconds in an emergency, called Rapid Access Data Recovery (RADR).

Read more...
Key design considerations for a control room
Leaderware Editor's Choice Surveillance Training & Education
If you are designing or upgrading a control room, or even reviewing or auditing an existing control room, there are a number of design factors that one would need to consider.

Read more...










While every effort has been made to ensure the accuracy of the information contained herein, the publisher and its agents cannot be held responsible for any errors contained, or any loss incurred as a result. Articles published do not necessarily reflect the views of the publishers. The editor reserves the right to alter or cut copy. Articles submitted are deemed to have been cleared for publication. Advertisements and company contact details are published as provided by the advertiser. Technews Publishing (Pty) Ltd cannot be held responsible for the accuracy or veracity of supplied material.




© Technews Publishing (Pty) Ltd. | All Rights Reserved.