Guide
EDR vs XDR vs MDR vs SIEM: what's the difference?
Five terms that get used interchangeably, explained side by side: what each one is, what it covers, who runs it, and how they fit together.
Last reviewed 18 October 2026.
The short answer
EDR, XDR and SIEM are technologies; MDR is a service; a SOC is a team. EDR detects and responds to threats on endpoints. XDR extends detection and response across endpoints, identity, cloud and network. A SIEM collects and correlates logs from almost any source and keeps them. MDR is a provider running detection and response for you. A SOC is the people and processes that do that work, in house or through a provider.
Side by side
| What it is | What it covers | Who runs it | |
|---|---|---|---|
| EDR | Endpoint detection and response: software on laptops, desktops and servers that records activity, detects threats and lets you respond, for example by isolating a device. | Endpoints | Your team or a provider |
| XDR | Extended detection and response: detection and response joined up across several layers, so one attack can be followed from stage to stage. | Endpoint, identity, email, cloud and network, depending on the platform | Your team or a provider |
| SIEM | Security information and event management: a platform that collects, correlates and retains logs, and alerts on suspicious patterns. | Almost any system that produces logs | Your team or a provider |
| MDR | Managed detection and response: a service in which a provider's analysts monitor, investigate and respond to threats for you, using tools such as EDR, XDR or SIEM. | Whatever the service is scoped to cover | A provider |
| SOC | Security operations centre: the team, processes and tools that watch for threats and respond to them. | The whole organisation, as scoped | In house, outsourced, or a mix |
EDR vs XDR
EDR sees what happens on endpoints in depth. XDR takes the same detect-and-respond idea and applies it across more of the environment, correlating signals from endpoints with identity, cloud, email and network data. If an attacker steals a password, signs in from somewhere new and then moves to a server, EDR sees the endpoint part; XDR is designed to connect the chain. Many XDR platforms are built on a vendor's EDR, so moving from one to the other is often an extension rather than a replacement.
MDR vs EDR and XDR
This is the difference between a tool and a service. EDR and XDR are technologies that need people to watch them, investigate alerts and respond. MDR provides those people. If your team cannot cover alerts when they happen, an EDR or XDR platform on its own can leave real threats unanswered; MDR closes that gap.
SIEM vs XDR
Both correlate signals to detect attacks. XDR focuses on detection and response across the sources it integrates closely with, and usually includes response actions out of the box. A SIEM takes logs from almost any source, including custom applications and older systems, and retains them for investigation and compliance reporting, but needs more work to tune and run. Many organisations use both, and some platforms now combine them. Our guide What is SIEM? goes deeper, including what ASD's ACSC recommends.
SOC vs MDR
A SOC is a capability; MDR is one way of getting it. Some organisations build their own SOC, some buy MDR, and many use a hybrid: an internal team supported by a provider.
Which do you need?
- Endpoints are the main gap: start with EDR, and make sure someone responds to its alerts.
- Attacks cross identity, cloud and email as well: look at XDR.
- You need logs from many systems kept for investigation or compliance: you need a SIEM.
- You do not have people to monitor and respond when alerts happen: add MDR, or a managed SOC.
How TOM SHAW helps
TOM SHAW delivers SOC, MDR and XDR services and SIEM implementation and managed SIEM for organisations across Australia, using platforms from our security partners, including SentinelOne and Vectra AI.
EDR, XDR and MDR: common questions
What is the difference between EDR and XDR?
EDR detects and responds to threats on endpoints. XDR extends detection and response across endpoints, identity, email, cloud and network, so an attack can be followed across all of them.
What is the difference between MDR and XDR?
XDR is a technology. MDR is a service in which a provider's security team uses tools such as XDR to detect, investigate and respond to threats on your behalf.
Is MDR better than EDR?
They are not alternatives. EDR is a tool; MDR is people using tools like EDR to respond for you. The question is whether you have the people to act on what EDR finds.
Do I need a SIEM if I have XDR?
It depends on what you need. If you must collect and keep logs from many systems for investigation or compliance, a SIEM still has a role. If XDR covers your important sources and you need its response actions, it may be enough on its own.
What is a managed SOC?
Security operations delivered as a service: a provider monitors for threats and responds, instead of you building and staffing your own SOC. It overlaps heavily with MDR.