Extended detection and response
Also known as XDR
Detection that correlates signals across endpoints, identity, email, and cloud rather than looking at each in isolation.
Individually, a foreign sign-in, a new inbox rule, and a PowerShell process might each fall below the threshold worth waking someone for. Together they are an active compromise. XDR exists to make that connection automatically.
The value depends entirely on how many of those signals you actually feed it. An XDR wired only to endpoints is EDR with a more expensive name.
Where this comes up
Extended detection and response sits inside our cybersecurity and threats work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.