Incident Response · Topic 2 of 4
Automating Response with SOAR, EDR, MDR and XDR
Learn what SOAR, EDR, MDR and XDR do, how they differ, and how a defender chooses and uses them to speed up detection and response for the CND 312-38 exam.
- 4 min
- SOAR = orchestration, automation and response through playbooks.
- EDR = agent based endpoint recording, detection, investigation and response.
- MDR = a managed service with human analysts, often 24 by 7.
What it is
Modern incident response relies on tools that collect telemetry, detect threats and act quickly. Four names are easy to confuse: SOAR, EDR, MDR and XDR.
- SOAR automates and coordinates response across tools.
- EDR watches and responds on endpoints.
- MDR is a service where an outside team runs detection and response for you.
- XDR unifies detection and response across many data sources.
How it works
Automating incident response with SOAR
Security orchestration, automation and response (SOAR) connects security tools and runs repeatable steps as playbooks.
| Part | What it does |
|---|---|
| Orchestration | Connects tools such as SIEM, firewall, EDR, email gateway and ticketing so they work together |
| Automation | Runs routine tasks without a person, such as enrichment and blocking |
| Response | Tracks cases, runs approved actions and records everything |
Typical use cases: triage a reported phishing email (extract links and attachments, check reputation, delete from mailboxes), enrich an alert with threat intelligence, block a malicious address on the firewall, disable a compromised account, or open and update a ticket.
Benefits are faster response, consistent steps, less analyst fatigue and a full record. A SIEM finds and correlates, and SOAR acts on what it finds. Keep a human approval step for risky actions such as isolating a production server, and test playbooks so they do not cause an outage.
Endpoint Detection and Response (EDR)
EDR places an agent on each endpoint (laptop, server, workstation). The agent records activity such as processes started, files changed, network connections and registry changes, and sends it to a central platform.
| Capability | Purpose |
|---|---|
| Continuous recording | History to investigate what happened |
| Behavioral detection | Flags suspicious behavior, not just known files |
| Investigation | Process trees and timelines show how an attack unfolded |
| Response | Isolate a host, kill a process, quarantine a file, roll back changes |
| Threat hunting | Search the data for hidden activity |
EDR goes beyond traditional antivirus, which relies mainly on known signatures. Its limit is that it only sees endpoints with an agent, so unmanaged devices are blind spots.
Managed Detection and Response (MDR)
MDR is an outsourced service. A provider combines technology and human analysts, usually around the clock, to monitor your environment, investigate alerts, hunt for threats and take or guide response.
| Reason to choose MDR | Note |
|---|---|
| No 24 by 7 security team in house | The provider supplies analysts at all hours |
| Skills shortage | Access to experienced responders |
| Faster time to value | Uses the provider's tools and playbooks |
Define in the contract what the provider may do (for example isolate hosts), how fast it reports, and how data is handled. The organization still owns the risk and the decisions.
Extended Detection and Response (XDR)
XDR extends the EDR idea beyond the endpoint. It collects and correlates telemetry from endpoints, network, email, identity and cloud, and presents connected incidents instead of separate alerts.
| Tool | Scope | Main strength |
|---|---|---|
| EDR | Endpoints | Deep host visibility and response |
| MDR | A service | People and 24 by 7 operation |
| XDR | Endpoint, network, email, identity, cloud | Cross domain correlation |
| SIEM | Logs from many sources | Log collection, search and compliance |
| SOAR | Across tools | Automation and playbooks |
An attack that starts with a phishing email, steals a credential and then moves to a server crosses email, identity and endpoint. XDR links these into one story.
A worked example
A user reports a suspicious email. A SOAR playbook pulls the sender, link and attachment, checks them against threat intelligence, finds the same email in 40 mailboxes and removes it. The playbook opens a ticket and asks an analyst to approve isolating one endpoint where the attachment ran.
The EDR agent on that endpoint isolates it and shows the process tree. The analyst then confirms nothing spread, and the lessons are recorded.
How the exam asks about this
- "Which technology runs playbooks that automate response across security tools?" → SOAR.
- "Which solution provides outsourced 24 by 7 monitoring and response?" → MDR.
- "Which solution correlates telemetry from endpoints, network, email and cloud?" → XDR.
What to remember for the exam
- SOAR = orchestration, automation and response through playbooks.
- EDR = agent based endpoint recording, detection, investigation and response.
- MDR = a managed service with human analysts, often 24 by 7.
- XDR = detection and response across many domains, wider than EDR.
- Keep human approval for high impact automated actions.
Automation can cause damage as fast as it fixes. A wrong playbook can block a business critical address or isolate a production server.
Common mistakes
Calling EDR the same as antivirus. EDR records behavior and offers investigation and response, not only signature matching.
Thinking MDR removes responsibility. The provider helps, but the organization still owns the risk.
Confusing SIEM and SOAR. SIEM detects and correlates, SOAR automates the response.
Check yourself
What is a SOAR playbook?
A defined, repeatable workflow of automated and manual steps for a type of incident.
What can an EDR tool do to a compromised endpoint?
Isolate it from the network, kill processes, quarantine files and provide a timeline for investigation.
How is XDR different from EDR?
XDR correlates data from endpoints plus network, email, identity and cloud, while EDR covers endpoints only.
Topic 2 of 4 in Incident Response
Test yourself on Incident Response
The full EC-Council 312-38 question bank has 800 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.