RR CYBERLAB • Detection & Response
EDR vs NDR vs XDR
Compare endpoint, network and cross-domain visibility and understand when each source is most useful.
QUICK READ
EDR shows what happened on hosts, NDR shows what systems communicated, and XDR correlates signals across sources. Strong investigations pivot between them.
Use this page after the daily quiz: learn the concept first, then follow the investigation workflow and examples.
NDR
Network telemetry can show source, destination, ports, protocols, timing and communication patterns. It is useful for network behavior and systems where endpoint telemetry is limited.XDR
XDR can correlate identity, endpoint, network and other security data into one investigation context. Analysts still validate the underlying events.Practical example
A suspicious login is followed by PowerShell and an outbound connection. Identity data explains access, EDR explains execution and NDR explains communication. Correlating all three creates a stronger timeline.Common mistakes
- Expecting one technology to provide every piece of evidence.
- Treating correlation as proof.
- Ignoring data quality and timestamp alignment.
Daily quiz hook
Which technology is most focused on endpoint process activity: EDR, NDR or XDR?
Quiz flow: introduce this topic briefly on social media, ask the question, reveal the answer, then send learners here for the detailed investigation.
Analyst practice note
EDR focuses on endpoint behavior, NDR on network activity, and XDR correlates signals across sources. Their visibility overlaps but is not interchangeable: an endpoint agent may see a process that a network sensor cannot, while network metadata can reveal peers outside endpoint coverage.
Practice with one event and ask what each source can independently establish. Correlation increases context, but duplicated alerts are not independent confirmation if they derive from the same underlying event.
Continue practicing: open a fictional mission and test your reasoning against the simulated evidence.