Ravindra BagaleCourses & study guides मराठी Track your progress

31. SOC, SIEM and Incident Response

31.8 EDR and XDR

By Last updated:

Example first. On 19 July 2024, a faulty update from CrowdStrike crashed about 8.5 million Windows computers. Airlines, banks and hospitals stopped. Why could one update do this? Because CrowdStrike Falcon is an EDR tool. It runs very deep inside Windows so it can see everything. That power helps catch attackers, but a bad update can also break the machine.

Why it matters

Old antivirus looks for known bad files. Modern attackers often use normal tools, like PowerShell, that antivirus trusts. A SOC needs a tool that watches behaviour on each computer and can act fast, even at night.

What it is

EDR = Endpoint Detection and Response. An agent (a small program) runs on each laptop and server. It records what programs do, spots bad behaviour and lets the SOC respond. XDR = Extended Detection and Response. It joins EDR with email, identity, cloud and network data into one view.

WordSimple meaning
EndpointAny device people use or servers run on: laptop, desktop, server, phone.
AgentA small program installed on the endpoint that collects data and takes action.
Behaviour detectionAlerting on what a program does, not just its file name.
IsolateCut a computer off the network, but keep the EDR link so the SOC can still work on it.
TelemetryThe stream of activity data the agent sends: processes, files, network connections.
ToolLooks atCan act?
AntivirusKnown bad filesDeletes the file
EDRBehaviour on each endpointKill process, isolate host
XDREndpoint + email + identity + cloudActs across all of them
SIEMLogs from everythingMostly alerts

Real products: Microsoft Defender for Endpoint, CrowdStrike Falcon and SentinelOne are EDR tools. Microsoft Defender XDR is an XDR product. The free Wazuh agent from Chapter 31.4 does some endpoint work, like file change checks and active response.

How a SOC uses it

  1. Install the agent on every laptop and server.
  2. The agent sends telemetry to the console.
  3. Rules flag strange behaviour and raise an alert.
  4. The analyst checks the process tree: which program started which.
  5. If it is bad: kill the process and isolate the host.
  6. Clean up, then add a rule so it is caught sooner next time.

Worked examples

Worked example 1: Word starts PowerShell

  1. A user opens an invoice in Microsoft Word.
  2. Word starts PowerShell, which downloads a file from the internet.
  3. Word should never do that. EDR raises a high alert.
  4. The analyst kills PowerShell and isolates the laptop.

Worked example 2: Ransomware on a file server

  1. One process starts renaming thousands of files to .locked in a minute.
  2. EDR sees this mass change and stops the process.
  3. It isolates the server so the attack cannot spread.
  4. The team restores the changed files from backup.

Worked example 3: XDR joins the dots

  1. Email tool: a user clicked a phishing link at 10:02.
  2. Identity tool: the same user signed in from a new country at 10:05.
  3. EDR: a strange program ran on the user's laptop at 10:07.
  4. XDR puts all three into one incident, so the analyst sees the full story at once.

Real incident: CrowdStrike faulty update (July 2024)

1. What happened

On 19 July 2024, a CrowdStrike Falcon content update made about 8.5 million Windows machines crash with a blue screen. This was not an attack, but it shows how deep EDR runs.

2. How it happened

  1. A bad content file was pushed to Windows computers running the Falcon sensor.
  2. The sensor runs at the kernel level, the core of Windows.
  3. The bad file made the core crash, again and again at start-up.

3. How to stop it

  1. Roll out updates in stages, a small group first.
  2. Keep a tested plan to recover machines, including disk encryption recovery keys.
  3. Treat security tools as critical software, with change control.

In short

  • EDR watches behaviour on each endpoint and can act.
  • XDR joins endpoint, email, identity and cloud into one view.
  • Antivirus checks known files. SIEM collects logs. EDR acts on the host.
  • Key response: kill the process, isolate the host.