SIEM, XDR and MDR: find the gap before buying another security layer

The most expensive mistake in a SIEM, XDR or MDR purchase is to solve a problem the security team already knows how to handle. Better correlation will not staff an empty night shift. A managed service will struggle if the critical application produces no usable evidence. A CISO needs to identify where an incident would stall before deciding which budget to increase.

The three labels are useful shorthand, but they are not three mutually exclusive choices. Security information and event management, or SIEM, centres on collecting and analysing security data. Extended detection and response, or XDR, connects detection and response across security controls. Managed detection and response, or MDR, supplies people and an operating service around agreed technology and responsibilities. Products and contracts can combine these jobs.

Follow an incident through three handovers

Consider a hypothetical incident: a finance employee opens a malicious attachment, their account is used from an unfamiliar location, and someone attempts to export payment records. The security team needs to connect the endpoint activity, identity events and application activity, decide what happened, then interrupt it without unnecessarily stopping legitimate payments.

The first handover is from systems to evidence. Can investigators find the relevant events, identify the same user across systems and establish a reliable sequence? If application logging is missing or identity fields cannot be joined, a more attractive incident dashboard does not fix the gap. Someone must own the source configuration, connector and data quality.

The second is from evidence to a decision. An alert needs context: whether the device belongs to the employee, whether the export is unusual for that role, and whether other accounts show related activity. Correlation can reduce the analyst’s assembly work. It still needs usable inputs and a detection approach suited to the environment.

The third is from a decision to action. Who can isolate the endpoint, revoke access, interrupt an export and bring the payment service back safely? A CISO should be able to name the responsible team at each handover, including outside normal working hours. The point at which that answer becomes uncertain is a better starting point for procurement than a preferred acronym.

Where the technology categories overlap

Microsoft’s documentation illustrates why “SIEM collects, XDR responds” is too simple. Microsoft Sentinel supports Microsoft and third-party data connectors, analytics that group alerts into incidents, and response playbooks built on Azure Logic Apps. SIEM capability can therefore extend well beyond a searchable log store. Whether that capability works for a particular payment application depends on the integration and the actions actually configured.

Microsoft Defender XDR coordinates signals across endpoints, identities, email and applications. Microsoft’s important qualification is that it correlates signals from products the customer has licensed and provisioned. A diagram showing broad coverage is not evidence that every component is present in your estate.

For the finance incident, that means asking the supplier to identify exactly which component contributes each event and which component performs each response. Record the required entitlement, deployment work and operating owner. An integration described as “supported” may still leave your team maintaining queries, credentials or custom workflows.

Unmet job	Likely investment to examine	What still needs an owner
Investigators cannot reconstruct activity across important systems.	SIEM coverage, source logging and integration work.	Data quality, detection content and evidence retention.
Related alerts remain separated across deployed security controls.	XDR correlation and response capabilities, or better integration of existing tools.	Deployment, tuning and approval of automated actions.
Useful alerts arrive, but nobody investigates or acts overnight.	MDR or another staffed operating model.	Business decisions, service restoration and the customer’s retained duties.

These are routes to investigate, not exclusive product assignments. A managed provider may operate a SIEM, an XDR platform or both. An internal team may already have enough technology and need time to make it work.

MDR changes responsibility only where the agreement says so

The service label is not permission to act. Sophos’s MDR response documentation distinguishes Collaborate, Authorize and Notify Only modes. Collaborate requires consent or active involvement for response, with an optional fallback to Authorize when contacts cannot be reached. Authorize permits proactive containment; the documented scope of full neutralisation also depends on service tier. Notify Only does not permit containment or neutralisation.

That distinction changes the finance incident. A provider may correctly identify the threat yet still wait for someone authorised to accept the operational consequences of stopping a device or account. If the customer expects autonomous response while the chosen mode requires approval, both parties can fulfil their documented roles and still leave the business exposed.

Agree in advance which actions may be taken, which require approval and which are unavailable. Identify exceptions for critical services and a reachable decision-maker for those exceptions. Keep restoration separate from containment: stopping an account’s access does not decide whether payment processing can safely resume.

Compare the cost of completing the work

Request a price for the same incident workflow from each option. Include source onboarding, necessary licences, investigation data retention, detection maintenance, analyst coverage and response permissions. Ask what happens to historical evidence, rules and cases when the contract ends. Treat those as explicit requirements, rather than assuming a category name guarantees them.

Also check which overlapping security capabilities can actually be retired. If two consoles create separate cases for the same incident, decide which is authoritative and who closes the other. Overlap is defensible when it adds evidence or resilience; it is expensive when analysts spend their shift reconciling queues.

The purchasing conclusion should fit in a sentence: “We need someone to investigate these signals and perform these approved actions overnight,” or “We need evidence from these applications before our existing team can investigate.” When the missing job is an operated response service, use those responsibilities to frame an MDR evaluation against your operating needs.