WHITE PAPER

The Case for Open XDR
X Means Everything

The current model for cybersecurity is broken.
It consists of acquiring and deploying a lot ofstand-alone tools, each with its own console,to analyze logs or traffic and detect anomalies
that could be threats. In this model, it’s up toeach security analyst to communicate withother analysts to determine whether each tool’s
individual detection (each of which, by itself, may
look benign), can correlate with other detections
from other tools to reveal a complex attack.

This platform approach can fix today’s broken
model by converting siloed tools into a unified
toolset, converting uncorrelated data into aliving correlated representation of the attack
surface, and converting alert fatigue into peaceof mind. How a technology realizes this goal is
the key architectural question. There are two
types of XDR today: Open and Native.

This model forces enterprises to create complex
security stacks consisting of SIEM, SOAR, EDR,NDR and more, for the purpose of instrumenting
the enterprise, identifying threats, responding tothreats, and managing risk. Acquiring all of thesetools and managing their licenses is complex andexpensive, and the manual correlation required
to compare each tool’s detections leaves a lot ofgaps in the overall security infrastructure.

• Open XDR is delivered via an open
architecture capable of leveraging existing
security tools’ telemetry and response
capabilities across the attack surface

Analysts are often bombarded with false
positives by these systems as well, causing“alert fatigue” and job dissatisfaction. Even
enterprises that declare themselves satisfied with
their existing SIEM and other tools will admitthat the amount of time and energy they havepoured into standing up a multi-tool security
infrastructure isn’t delivering the requisite results.

The Case for XDR
XDR, or eXtended Detection and Response, has
become a catch-all definition for any technology
performing detection and response, because
in the acronym, X is really a variable. While X
can represent “Endpoint+” or “Network+”, that
disregards the present pain of the enterpriseof siloed tools, uncorrelated data, and alert
fatigue. The whole goal of XDR is to address thispain, and therefore X has to mean “Everything.”
Everything, then, implies a platform approachto covering the entire attack surface throughdetection and response.

Open vs. Native XDR• Native XDR is delivered from a single
vendor’s security tool suite thatprovides telemetry and response acrossthe attack surface
Regardless of the architectural approachof an XDR platform, it must satisfy thefollowing technical requirements in order
to be considered XDR:
• Deployability – Cloud-native microservice
architecture for scalability, availability
and deployment flexibility• Data Fusion – Normalized and enriched
data across the entire attack surface
including network, cloud, endpoints,
applications and identity• Detection – Real time, high-fidelity
across multiple security tools• Correlation – Correlated detections
resulting in context-aware incidents• Intelligent Response – One-click or
automated response from the same platform

www.stellarcyber.ai

sales@stellarcyber.ai

XDR Architectures Compared*Short List ofRepresentative Tools Shown

INTELLIGENTRESPONSE

CORRELATION

DETECTION

Open XDRNative XDRResponds to Existing Tools

Responds to Built-in Tools

Integrates with Existing SOAR or
Provides SOAR Funcionality

Built-in SOAR Responds
to Built-in Tools

Correlates Detections

Correlates Detections

Approach Will Vary by Vendor –ML, Rule-based, etc.

Approach Will Vary by Vendor –ML, Rule-based, etc.

Generates Detections

Generates Detections

Detects on Tool Alerts and/or
Raw Data via ML and/or Rules

Detects on Tool Alerts and/or
Raw Data via ML and/or Rules

Fuses Existing Tools*

Fuses Built-in Tools

DATA FUSION

NativeVendor FW

Flexible Deployment
DEPLOYABILITY

SaaS

PrivateCloudA common misconception about Open vs. Native
XDR is that they are mutually exclusive typesof XDR. They are not. An XDR platform can be
fully Open, and partially Native. For example,
an XDR platform can have a few built-in tools
from its vendor while openly integrating withNative Vendor
Endpoint

Flexible Deployment

OnPremSaaS

PrivateCloudOnPrem

the existing tools from the other vendors. Thisenables a Composable Security strategy, theability to leverage the existing tools while allowing
the customer to sunset some of them when andwhere they see fit.

Dimensions of XDRNative Only
XDR

Native XDRwith Open
Attributes

NativenessOpen XDRwith Native
Attributes

Does Not Fulfill
Promise of XDROpen XDR
OnlyOpenness
www.stellarcyber.ai

sales@stellarcyber.ai

The composition of Open vs. Native XDR that aplatform takes in its approach is a means to an
end: specifically, how the platform goes about
performing detection and response across theentire attack surface. Buyers of XDR need to view
the architectural approach as a means to an end
and make the best decision for their enterprise.

The Ideal XDR is OpenThere will be some enterprises that have noissue moving their entire security stack over to asingle vendor, and adopting a closed, Native XDR
platform. There will also be some enterprises thatcare less about covering the entire attack surface,and only want detection and response for theirendpoints, for example. In this case they should
pursue an EDR-based Native XDR platform.

network, identity, etc. tools, so a Native-only XDR
platform won’t be best-of-breed. In addition, it’s
extremely likely that the enterprise has alreadyinvested significant capital and effort in deploying
existing security tools – it won’t want to abandon
those investments, so a closed, Native XDR
solution wouldn’t interact with those tools andwouldn’t capture the entire attack surface at thatenterprise. If an Open XDR platform has some
Native attributes to cover certain areas of theattack surface for growing enterprises, great. But
it must be Open first.
In the end, if an enterprise wants to define andexecute a Composable Security strategy and get
all of XDR’s technical requirements delivered
through a platform, a fully Open XDR platform isthe only realistic way to do so.

However, for most enterprises, an Open XDR
platform must be looked at as the top priority.
Why? Because no single vendor will ever be able
to create or acquire the best cloud, endpoint,

Stellar Cyber’s Open XDR platform delivers Everything Detection and Response by ingesting data from all tools,
correlating incidents across the entire attack surface, delivering high-fidelity detections, and responding to threats
automatically through AI and machine learning. Our intelligent, next-gen security operations platform greatly reduces
enterprise risk through early and precise identification and remediation of all attack activities while slashing costs,
retaining investments in existing tools and accelerating analyst productivity. Typically, our platform delivers a 20X
improvement in MTTD and an 8X improvement in MTTR.

www.stellarcyber.ai | sales@stellarcyber.ai