What does XDR stand for?
XDR stands for Extended Detection and Response. Extended detection and response: it correlates telemetry from endpoints, network, cloud and email to detect and respond across all of them, beyond endpoint-only EDR.
XDR extends the EDR idea beyond the endpoint. One platform collects signals from endpoints, email, identities, cloud applications and the network, links them into a single incident and can respond across all of them. The benefit is fewer separate alerts: the phishing email, the stolen sign-in and the malware on the laptop appear as one story.
XDR in practice: an example
A user receives a phishing email, enters a password on a fake page and the attacker signs in from abroad and creates a mailbox forwarding rule. An XDR incident shows the email, the risky sign-in and the rule together, and offers to remove the email, revoke the session and delete the rule.
What XDR is confused with
XDR vs EDR: what is the difference?
EDR sees the endpoint. XDR adds email, identity, cloud and network data and correlates them out of the box. What EDR stands for
XDR vs SIEM: what is the difference?
A SIEM takes logs from any source and needs rules to be built. XDR works with a defined set of integrated products and ships its correlations ready-made. What SIEM stands for
Which exams cover XDR?
XDR is on the official CompTIA acronym list for three of the four exams covered here.
- Security+ SY0-801: 4.1 (Security Operations).
- CySA+ CS0-004: 1.3 (Security Operations).
- A+ 220-1201 and 220-1202: 220-1202 2.0 (Security).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. A company wants one console that links a malicious email, the resulting sign-in and the endpoint infection into a single incident without writing correlation rules. What fits best?
- A network tap
- XDR
- A standalone IDS
- A backup appliance
Show the answer
B. XDR. Cross-domain correlation that works out of the box is the defining feature of XDR. An IDS or a tap sees only network traffic.
2. Which statement about XDR is accurate?
- It replaces the need for multifactor authentication
- It only monitors servers
- It correlates telemetry from several security layers
- It is a type of VPN
Show the answer
C. It correlates telemetry from several security layers. XDR is defined by collecting and correlating data across endpoint, email, identity, cloud and network layers. It does not replace preventive controls such as MFA.
Sources: NIST glossary: extended detection and response; Microsoft Learn: What is Microsoft Defender XDR?. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.