EDR, MDR & XDR Explained

[@rockychau2451]

one of the best explanation so far on KZbin

[@ProTechShow]

Thanks 🙂

[@Wahinies]

Yes and I am catching it at the perfect time. Many thanks @ProTechShow

[@OMOM-m2d]

I second this. Includes all the various important comparison points to form an informed perspective!

[@JakeDigweed-c5y]

Great video! In our everyday work as MSPs, having solid cybersecurity, reliable backups, and smart monitoring tools in place is absolutely essential. They’re the backbone of keeping things running smoothly. UCaaS platforms, like the Thirdlane Multi Tenant PBX, really make a huge difference by ensuring that communication stays seamless and secure, no matter what. It’s all about making sure everything works together effortlessly!

[@ProTechShow]

Thanks

[@neomatrix2091]

Very nice breakdown, i appreciate your effort on presenting these concepts on a simplified manner for us to understand!

[@ProTechShow]

Thanks!

[@DeViL-g2q]

This was the actual video I needed. The formula: XDR = EDR + SIEM lite + SOAR lite is awesome

[@ProTechShow]

Glad to hear it was helpful

[@MichaelP-g5n]

excellent high level explanation of these technologies.

[@ProTechShow]

Thanks!

[@richlab2927]

Love your explanation. You made it simple

[@ProTechShow]

Thanks! Glad it's useful.

[@marcioguedescavalcante3094]

Oh man, thank you so much to make this!

[@ProTechShow]

You're welcome. Glad it's of use!

[@wizardofwifi]

This is a great summary of these topics, Cybersecurity 101 foundation, simply explained!

[@ProTechShow]

Thank you 🙂

[@velvijaykum]

Well explained. Much appreciated.

[@ProTechShow]

Thanks!

[@elijahcrawford3049]

....and now my 8 page research paper due today makes sense.....thank you!

[@ProTechShow]

You're welcome

[@GeauxTube1212]

Awesome breakdown!

[@ProTechShow]

Thanks 🙂

[@Israelxox]

Underrated video! Thanks 🙏

[@ProTechShow]

Thanks for watching!

[@notevenfalse]

A+ content mate. All I can say is thank you.

[@ProTechShow]

Thanks 🙂

[@priyakalai-hf4dd]

Could please explain more about MDR

[@acmshift]

Amazing breakdown. Thank you!

[@ProTechShow]

Thanks. Glad it's useful!

[@MENTOKz]

thanks man just starting to learn are XDR tool trend micro one

[@GrayCatPI]

This breakdown of EDR, MDR, and XDR is really helpful. How can small businesses determine which option is the best fit for their security needs?

[@ProTechShow]

If you don't feel you have the in-house expertise to figure it out then I suspect MDR would be a good choice - let someone else handle the bulk of it for you.

[@asdkjh4370]

Thanks for video. Many thanks for valuable advice. Something on OpenHAB maybe? I'm looking for something to switch from HA which is going strange way. Any new updates?

[@ProTechShow]

OpenHAB 4 is expected to land in a couple of weeks. 2 and 3 were quite significant updates, so it'll be interesting to see what 4 brings to the table.

[@DesignThinking8989]

Thank you! I've learnt so much from this video :D

[@ProTechShow]

Glad it was helpful!

[@Liz-y1d]

Edr End Point Response, Adr data breach, for future & Rdr are all separate packages of…?

[@eek0212]

I was sick of all those security acronym terms, thanks for the video mate

[@ProTechShow]

You're welcome. Glad it was useful.

[@nitram419]

Many thanks indeed for a great tutorial! I just have a question about the restoring the system image created using the built-in Windows backup tool **to a brand new SSD**. Here's my scenario: ~ I have one NVMe SSD slot, with my OS C: drive on it. ~ In Windows I make an system image of the above, using the Windows backup tool; ~ I also make a Windows DVD bootable DVD (ie. with the recovery tools). ~ I turn off & unplug the PC and remove the old NVMe drive. ~ I insert a brand new and bigger NVMe drive in the slot where the old one used to be. ~ I boot the machine using the DVD-ROM Windows bootable recovery tools disk. Question: How do I get the image onto the brand new unformatted NVMe drive, and assign it as the "C" drive? Most grateful for your advice!

[@riccardo1434]

Hello, I've got some questions: is EDR a software agent that needs to be installed on each endpoint? while XDR is centralized or does it need to be installed on every endpoint like EDR? In order to monitor endpoint, firewall, cloud, network, etc. etc. activities to perform analysis, threat intelligence and response? Also, does XDR need EDR to collect activity information or does it completely replace EDR?

[@ProTechShow]

Usually, EDR is a software agent that gets installed on endpoints and checks in to a central location, similar to most business antivirus solutions. XDR does this as well, but additionally consumes data from other devices - usually via API calls or syslog.

[@funbala]

Great explanation. Thank you so much. What do you suggest for a startup company that has both Windows and mac devices to protect from malware threats. EDR or XDR which one is cost effective and able to manage by the IT member.

[@ProTechShow]

EDR would be cheaper, like-for-like; but vendors usually offer one option so you're not really going be comparing like-for-like and will see more of a difference between different vendors than EDR Vs XDR. If it's for a start-up I would lean towards MDR so you can focus on growing your business and let someone else worry about chasing down activity alerts.

[@alejandro88353]

you are a hard in this themes! thank you 🤙

[@ProTechShow]

You're welcome

[@glenbearman8989]

Fantastic video. Thanks

[@ProTechShow]

Thank you too!

[@kaentertainment2215]

How does EDR defend against Zero Day Exploits given its primary focus on detecting suspicious patterns from historical occurrences?

[@ProTechShow]

Let's say you have an internet-facing web app with a zero-day vulnerability. It gets exploited to drop a web shell onto the server. The vulnerability was previously unknown, and the web shell doesn't match any known malware patterns. EDR/antivirus may not initially detect the exploit or the web shell as malicious, but EDR will see the file creation/modification by the web server process, followed by it attempting to spawn child processes or execute commands that are not typical behaviour of a web server. It doesn't require knowledge of the vulnerability itself to detect suspicious behaviour resulting from its exploitation and take action - raising an alert, removing the file, isolating the system, etc.

[@kalagalaedrine5911]

In addition known EDRs normally run a baseline (hash value) on the files in an end point where it's deployed the first time based on which it monitors the changes (integrity checks)... it's on this nortion that it would flag alerts for the analysts to validate or orchestrate next actions. An integration of your EDR to a SOAR would be a value add

[@Akshaykumar_Chitare]

Thank you for video 😊

[@ProTechShow]

You're welcome 🙂

[@hammamiahlem9792]

amazing explanation ! thank you

[@ProTechShow]

Thanks!

[@michalriha9203]

Great!!! What an easy explanation

[@ProTechShow]

Thanks 🙂

[@fastrobreetus]

Very informative

[@ProTechShow]

Thanks!

[@Liz-y1d]

mDR eDR & xDr , what is the diff?

[@ChapalPuteh_]

We use only XDR and EDR to operate our incident in the network ..

[@DawidKellerman]

See clear as mud! Dont trust the sales people listen some who clearly knows! This was a cut thru FUD for me

[@ProTechShow]

Thanks 🙂

[@paulj9657]

Not acronyms. They are initialisms. :-) Great info. Thanks.

[@ProTechShow]

You are... correct. They are initialisms.

[@paulj9657]

Sorry, my dad was an English teacher. :-). I'm not that pedantic in real life.

[@Pem7]

🤞🏾

[@md.tariqalamchowdhury8798]

😃

[@sheiladikshit5110]

i just use XTC and don't have a care in the world.

[@iamagastya0]

i think toyota have better CooL cars