SIEM, SOAR, EDR and XDR: a guide to security operations
Understand four security operations terms, their different roles, and how teams can use telemetry and response workflows together.
Security teams use several kinds of tools to collect evidence, investigate suspicious activity and coordinate a response. SIEM, SOAR, EDR and XDR describe related capabilities rather than a single mandatory architecture. Products differ in scope, integrations and operational controls; a label alone does not establish what a product actually does.
## SIEM: collect and analyze security events
Security information and event management (SIEM) systems bring together security data from multiple sources, such as server, identity or network logs, and present it for analysis. Logging records events for later review; a SIEM may normalize and correlate those events to help analysts identify patterns. Data quality, time synchronization, retention and source coverage affect what can be found. See [NIST's SIEM tool definition](https://csrc.nist.gov/glossary/term/Security_Information_and_Event_Management_Tool).
## SOAR: coordinate response workflows
Security orchestration, automation and response (SOAR) connects tools and people in a repeatable response workflow. A playbook might collect context, create a case and request an analyst's approval before an account is disabled. Automation is not necessarily fully autonomous: permissions, approvals and reversible actions should match the organization's response plan. [CISA's security capabilities catalog](https://www.cisa.gov/sites/default/files/2025-07/CISA%20TIC%203.0%20Security%20Capabilities%20Catalog.pdf) describes SOAR as a way to define and automate incident response.
## EDR: investigate endpoint activity
Endpoint detection and response (EDR) focuses on activity on endpoints such as computers or servers. An EDR capability can collect endpoint telemetry, surface suspicious behavior and, where configured and authorized, support actions such as isolating a device. Availability and response functions vary by product and deployment; an unmonitored device remains a blind spot. [CISA's technical capabilities](https://www.cisa.gov/sites/default/files/publications/cdm-technical-capabilities-vol2-v24.pdf) describe endpoint data and policy-controlled response actions.
## XDR: correlate across security domains
Extended detection and response (XDR) generally refers to detection and response using correlated signals across multiple domains, which can include endpoints, identity, email, network or cloud services. Which domains and actions are actually supported depends on the implementation. [Microsoft's security benchmark](https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-v2-endpoint-security) describes one approach to correlating endpoint and other telemetry; it is an example, not a claim that all XDR products have identical coverage.
## Threat intelligence: context for decisions
Threat intelligence is threat information that has been analyzed or enriched with context to help people make decisions. It is different from a raw indicator or an unverified claim: an intelligence assessment should explain its evidence, source, relevance, timing and uncertainty. [NIST's definition](https://csrc.nist.gov/glossary/term/threat_intelligence) describes the role of analysis and context in making threat information useful.
For example, an advisory might describe a technique used against a particular class of service. A security team can check whether that service is in its inventory, compare the reported behavior with its own telemetry and use the finding to prioritize an investigation or patch. A match is not automatically proof of compromise or of an attacker's identity. Evaluate source reliability and freshness, document confidence and limits, and avoid distributing sensitive incident details without authorization.
## How the pieces work together
In an illustrative incident, an endpoint alert and an unusual sign-in reach an analyst. A SIEM can make relevant event records available; an XDR capability may correlate related signals; EDR can provide endpoint context; and a SOAR playbook can gather details and route a containment decision. The team verifies whether records refer to the same activity before taking action. These roles can overlap within one product or across several products.
A security operations center (SOC) is the team or function that monitors and responds to security activity. Security monitoring involves observing selected systems and events for signs that need investigation. Detection engineering develops and maintains the rules and logic used to identify relevant activity; threat hunting is a proactive search for possible threats that existing alerts may not have surfaced. These activities need suitable data, clear ownership and follow-up, not only tool installation.
Choose tools based on the systems and evidence they actually cover, access permissions, data handling, response safety and the team's ability to operate them. Test detections and playbooks, review false positives and missing telemetry, and preserve evidence during an incident. These are general concepts, not claims about a particular Mithril service or guarantee of detection. See [Mithril's incident response guide](https://blog.mithril.fund/cyber-incident-response-by-country?lang=en). Sources reviewed on 2026-10-29.