xsiam and xdr

[winston]

can someone explain the difference between xsiam and xdr, it seems most of the modules in xsiam are also in the xdr, is xsiam the second generation of xdr?

[JGonzalez676]

Its XDR plus supposedly SIEM replacement functionality plus automation.  So think single pane for XDR, SIEM and SOAR.  Though as much as they claim its a SIEM replacement, it clearly is not. 

[afurze]

Hi Winston,

Cortex XSIAM is logical progression, as it were, of several Cortex solutions including XDR, and XSOAR.  It also includes many SIEM like components including a standard data model, allowing you to ingest all of your security solution data into a single platform and then apply our AI driven Analytics Engine for anomoly detection, and XSOAR-style automation to perform tasks like enrichment and automated response actions.  While XSIAM does include many components of XDR including the XDR agent itself for endpoint protection, many of it's features, especially around 3rd party data collection and automation, are not.

While it is accurate to say that XSIAM's goal is to displace customer's existing SIEM solutions, it is not a traditional SIEM itself.  Instead, it is designed to be a single location to ingest security related data, apply our advanced analytic capabilities, and automate your response process to ensure that analysts spend time only on incidents which need further triage or response actions.

Of course, this is a very high-level overview and there are many other great inclusions like attack surface management, threat intel management, the data model, etc.  Please reach out to your account team for a more detailed discussion of your use cases and pain points to see how Cortex XSIAM can help you get closer to our vision of the automated SOC.