WHITE PAPER

Open XDR vs. SIEM
Matching Resources and Business Riskwith the Right Solution

Gaining visibility and responding to attacks
across the entire enterprise infrastructure(endpoints, servers, applications, SaaS, cloud,users, etc.) is a very tall order in today’s
cybersecurity environment. Enterprises areforced to create complex security stacks
consisting of SIEM, UEBA, SOAR, EDR, NDR, TIP
and other tools in order to meet this challenge.
For many enterprises, SIEM is the main toolfor aggregating and analyzing data from theinfrastructure. Nearly half of enterprises reportthat they are not satisfied with their SIEMs1,but all enterprises will be quick to point out
the amount of capital, time and resources they
have poured into standing up and maintaining
their SIEMs. Open XDR is emerging as a new
approach addressing the challenge of gaining
visibility and responding to attacks across theentire enterprise infrastructure. In this article,we’ll look at how Open XDR and SIEM measure
up as security solutions.

Defining Open XDR
Gartner defines XDR, or eXtended Detection
and Response, as “a unified security incident
detection and response platform that
automatically collects and correlates data frommultiple proprietary security components.” Thisdefinition, dating back to 2020, does not capture
Open XDR as an emerging category of XDR thatcollects and correlates data from all existing
security components, not just proprietary or
single-vendor ones. So, Open XDR is defined thesame as Gartner’s XDR definition except thatit ends with “all existing security components,delivered via an open architecture”. The Open vs.
Native XDR difference is discussed in detail in
another article. In this article, we focus on OpenXDR as it compares to SIEM. So Open XDR has
the following technical requirements to fulfill thepromise of the above definition:• Deployability – Cloud-native microservice
architecture for scalability, availability anddeployment flexibility• Data Fusion – Centralize, normalize andenrich data across the entire attack surface,including network, cloud, endpoints,
applications and identity• Detection – Built-in automated detections
through Machine Learning• Correlation – High-fidelity correlated
detections across multiple security tools• Intelligent Response – One-click orautomated response from the same platform.
Sound similar to SIEM plus a little SOAR?
That’s because it is. However, there are majorarchitectural differences that allow Open XDR todeliver on many of the promises of SIEMs where
SIEMs have fallen short.

Defining SIEM
Gartner defines SIEM, or Security Informationand Event Management, as technology that
“supports threat detection, compliance andsecurity incident management through thecollection and analysis (both near real timeand historical) of security events, as well as awide variety of other event and contextual datasources.” This definition is notably similar to thedefinition of XDR. Architecture is where thebiggest differences lie, but purely definitionallya SIEM was named after its main purpose - tomanage information and events. XDR was also
named after its main purpose - to detect andrespond. This may seem like a minor point,
but this difference in business purposes iswhat drives the architectural approach, and is
why SIEMs are so capital-intensive in today’ssecurity environment.

Architectures ComparedThis comparison focuses only on thedifferences. There are a number of technicalsimilarities including long-term storage, open
integrations with security tools, cloud-nativity,and efficient search and threat-hunting.

www.stellarcyber.ai

sales@stellarcyber.ai

However, Open XDR has five key architecturaldifferences from SIEMs:

a platform, it will be an impossible problem
to maintain AI models. XDR forces data to bemodeled the same way across each deployment
before data lands into a Data Lake; data is
only available in its normalized and enrichedstate. SIEM either provides this as optional
functionality or does not provide this feature
at all; in the optional case, normalization andenrichment is treated as a post-processing step
on raw data that is already stored.

1. Data is forced into a normalized andenriched state, and this is done before
the data are stored in a data lake.
2. Detections and correlation of alerts areautomatically driven by AI in Open XDR,
not human-written rules as with SIEMs.
3. Incidents are produced from correlated
alerts, from which a single response on thesame platform is orchestrated, compared
to a SIEM, which sends alerts to a different
SOAR platform which then performs
downstream correlation and response.

In summary, on technical differences 1 and2, Open XDR forces normalization andenrichment on data, so it is capable of building
meaningful AI that correlates events andalerts together. For the same reasons, SIEM
architecture is not able to produce an AI engineof the same fidelity because of its treatment ofdata. SIEMs will be able to leverage AI, but it
will be difficult to scale.

4. Many tools required for security operations
are unified, such as Big Data Lake, UEBA,SOAR, TIP, NDR or EDR on one platform
while many SIEMs only include a Big Data
Lake, forcing SIEM users to manuallycombine many complex tools together
by themselves.

Technical difference 3 comes down to an OpenXDR performing correlation and response in
the same platform. A higher order constructof an incident (multiple related alerts) isautomatically produced in an Open XDR
platform, and that is responded to holistically.
A SIEM must pass alerts to a SOAR, which mustcorrelate alerts together with rules without
the deep context of everything happeningDifferences 1 and 2 go hand in hand. In order tobuild and maintain meaningful AI in any industry,
the data problem must be solved. In security,that means data must be centralized, normalized
and enriched to reduce data complexity. If data
is modeled differently at each deployment ofDeployment

NOT SCALABLESCALABLE

Heavy Services Required

Little/No Services Required

SIEM Data

SIEM Rules

Open XDR Data

Open XDR AI ModelAIX

BJX

CKX

www.stellarcyber.ai

sales@stellarcyber.ai

in the environment. Open XDR produces aresponse just like a SIEM and SOAR does,
but the response fidelity is much greater with
XDR because it is orchestrated from the same
platform performing detections and AI-driven
correlations, where all the data is available.
The final technical difference is centeredaround the approach to building andmaintaining the overall security stack. OpenXDR was designed to unify all key tools forsecurity operations such that they can beorchestrated from one platform. Many SIEMs
offer long lists of plugins and deep levels ofcustomization, but that puts the onus on theusers to build and configure their system.
For the enterprise, these technical differences
influence the capital, time and resources ittakes to run a security platform. SIEMs areopen-ended technologies, so they are going to
be expensive to operate. Open XDR platforms
are security prescriptive technologies, andtherefore enterprises will be much more
efficient when employing them.
Finally, while not strictly technical differences,
two areas where SIEMs have focused much
more are on heavy compliance-related storage
and use of the same platform for IT Operations.
XDR is designed for the outcome of detection
and response. It can still meet compliancerequirements, but it was not designed forthat from the start. IT Operations in the same
platform is something that only SIEM can claim,
as Open XDR is strictly focused on security.

What About NG-SIEMs?
“Next Gen” anything signals something that isbetter, not different. NG-SIEMs are better than
SIEMs in the hypothetical sense. Open XDR isdifferent from both. NG-SIEMs brought hugeadvancements in many areas where legacy
SIEMs were not keeping up with the demandsof today’s security environment. Notable
improvements are:• Use of Big Data technologies (no more
SIEM constantly falling over)• Some User and Entity Behavior Analysis(UEBA) through various algorithms• UI/UX improvements to key workflows
like Threat-Hunting• Native or open integration with SOARs• Data modeling plugins.
NG-SIEMs certainly close the capability
gap between Open XDR and SIEM, but thearchitectural differences remain the same.

Some Vendors Say They Offer A SIEM
and An XDR Platform – What Gives?
There are many similarities between SIEM
and Open XDR, as noted above. The technicaldifferences are nuanced, but have major
implications on business value and capitalrequired to operate. There are two claims
vendors are making if they are using both
SIEM and Open XDR to describe their product.
The first claim vendors may make is that they
may use “SIEM Capabilities” to refer to theirOpen XDR platform having all the importantcapabilities of a SIEM - open collection, storage,
search, reporting, cloud-native - as a way todescribe how Open XDR can be deployed in anenterprise security stack, specifically to replace
an existing SIEM.
The second claim vendors may make is to saythat their platform is both a SIEM and an OpenXDR platform. This is a confusing point likely
to ensure that the vendor does not miss out
on potential category marketing and can sell aproduct to customers regardless of whether they
are looking for SIEM or Open XDR. As discussed
above however, SIEM and Open XDR aredifferent, so the same product cannot be both.

www.stellarcyber.ai

sales@stellarcyber.ai

Navigating The Collision Courseof XDR And SIEMXDR is on a collision course with SIEM andSOAR, as noted by Forrester2. Enterprises need
to approach both technology categories with
their long-term business outcomes and available
resources in mind. Is high fidelity, automateddetection and response out of the box more
important? Is the capability of response fromthe same platform by the same team criticalto reduce the attack dwelling time? Is the teamshort-staffed and/or needs lots of training to run
the tool? These are the key questions enterprises
must bring to the table when defining theirsecurity stack strategy and deciding whether
XDR or SIEM is right for them.

[1] 2017 Ponemon SIEM Report[2] https://www.forrester.com/report/Adapt+Or+Die+XDR+Is+On+A+Collision+Course+With+SIEM+And+SOAR/-/E-RES165775

Stellar Cyber’s Open XDR platform delivers Everything Detection and Response by ingesting data from all tools,
correlating incidents across the entire attack surface, delivering high-fidelity detections, and responding to threats
automatically through AI and machine learning. Our intelligent, next-gen security operations platform greatly reduces
enterprise risk through early and precise identification and remediation of all attack activities while slashing costs,retaining investments in existing tools and accelerating analyst productivity. Typically, our platform delivers a 20X
improvement in MTTD and an 8X improvement in MTTR.

www.stellarcyber.ai | sales@stellarcyber.ai
www.stellarcyber.ai

sales@stellarcyber.ai