XDR Fundamentals and Platform Components
What the exam tests here
This domain covers architecture: how an XDR platform ingests endpoint, network, identity, email, cloud and SaaS telemetry, normalizes it, correlates across sources, and drives response. Expect questions that ask you to distinguish a true cross-source detection platform from a rebranded EDR console, and to identify what breaks when a source is missing.
Core rules and components
- Native vs hybrid/open XDR. Native XDR is single-vendor with tightly coupled sensors and prebuilt cross-source analytics. Open/hybrid XDR ingests third-party telemetry and depends on schema normalization (for example ECS or OCSF) to make joins possible. Unnormalized data cannot be correlated reliably.
- Pipeline stages: collection (endpoint agents, network taps, API connectors to identity and cloud providers) → normalization and enrichment (asset criticality, identity context, threat intel) → detection (correlation rules, behavioral analytics, risk scoring) → investigation (timeline and entity graph) → response (native action or SOAR handoff) → retention tiering.
- Risk-based alerting aggregates many low-fidelity signals on one entity into a single scored incident instead of alerting on each.
Worked example
An alert fires for encoded PowerShell on host A. The endpoint record shows the command line; the identity log shows the same user signing in from a new ASN eight minutes earlier; the cloud audit log shows a new OAuth application consent. Reasoning: the endpoint alert alone is medium confidence, but the identity and cloud joins indicate credential or token compromise, so the correct pivot is identity containment (revoke sessions) rather than only killing the process on the host.
Traps that cost marks
- Assuming more telemetry always improves detection; volume without normalization and enrichment creates noise.
- Forgetting identity and cloud onboarding, which is exactly where modern intrusions begin.
- Treating correlation as simple time-window matching; entity (user, host, IP) joins carry the real signal.