An ordinary Tuesday in a SOC means ten or twenty thousand alerts. Sometimes more. DXC Technology helps security teams see which of those alerts belong to the same incident. They come from the EDR, from the firewall, from the cloud console, plus whatever the identity team bought last year, and each one has its own tab. The phishing email, the weird process on a laptop and the odd download from a cloud bucket rarely end up on one screen. So the attacker gets a week or two to look around. Sometimes longer.
Why Siloed Security Tools Give Attackers Extra Time
Nobody's short on data, honestly. The trouble is where it lives: five or six consoles, each with its own alert format and its own opinion on what "critical" means. Which is why plenty of SOC teams, tired of clicking through the same response steps by hand every night and wanting one console instead of six, have started adding https://dxc.com/solutions/cybersecurity/unified-security to their daily operations. Usually it sits right next to the EDR or SIEM that's already been paid for.
Now picture the night shift. Somebody's on their third coffee when a medium-severity alert comes in from the EDR. Is there any quick way for them to know the same user signed in from Lisbon and Lagos forty minutes apart? Or that a fake DocuSign link landed in that mailbox yesterday afternoon? Not really. So the ticket gets closed with "no further action," and whoever sent that link keeps going.
Mandiant's M-Trends 2025 put the global median dwell time at 11 days. IBM's number is grimmer: in its 2025 breach report, finding and containing a breach took 241 days on average. Eight months, give or take.
A pretty normal Monday in a siloed SOC goes something like this:
- The email gateway grabs a sketchy .iso file, quarantines it and closes the case on its own. Nobody even sees it.
- Somewhere in accounting, Word suddenly launches rundll32.exe. The EDR rates it medium and moves on.
- Entra ID logs an impossible-travel sign-in, but that alert goes to the IAM team, who look at it on Wednesday.
- CloudTrail spent the weekend logging a few thousand GetObject requests from some unknown IP. Did anyone open that dashboard? Nope.
Four signals, one attack. Zero incidents.
XDR vs SIEM/SOAR: Where the Difference Really Shows
Hold on, isn't this what a SIEM is for? Kind of. Splunk and Microsoft Sentinel eat logs all day long. Somebody still has to write correlation rules for them, though, and that somebody ends up maintaining those rules for years. SOAR adds automation on top. Every connector, though, is one more thing that breaks the day a vendor tweaks its API, usually on a Friday.
XDR flips the order. Data from laptops, mailboxes and cloud accounts lands already normalized. Detections? Mostly prebuilt by the vendor. Isolate, kill, block and disable sit one click from the alert, so nobody opens three other logins at 2 a.m.
Does the SIEM go in the bin, then? Hardly. Most SOCs keep it for the dull but necessary jobs, like holding a year of logs for auditors or reading data from that ancient mainframe nobody dares to touch.
Why Cross-Domain Telemetry Matters
It's all about the joins. Once a laptop event and a cloud login share the same user and session ID, the platform ties them together automatically, so no one has to juggle six tabs and an Excel sheet. More alerts is the last thing anyone needs. Fewer of them, ones that actually make sense, is the whole goal.
Incidents, Not Alert Piles
Each big vendor has its own take. Microsoft Defender XDR, for one, rolls alerts from endpoints, Office 365, Entra ID and Defender for Cloud Apps into one incident that tells a single attack story. Palo Alto went with a causality chain in Cortex XDR, running from the process tree out to network sessions and firewall logs. SentinelOne's Storyline walks every event on a host back to the process that started the mess. CrowdStrike, in Falcon Insight XDR, pins MITRE ATT&CK labels and its own intel onto the process tree.
Same idea, different flavors. In real deployments, 12,000 raw alerts shrinking to somewhere around 150–200 incidents is pretty typical. Eight analysts can handle 150 in a shift. Not 12,000.
Automated Playbooks: From First Alert to Contained Host
Spotting an attack is one job. Stopping it is another, and that second part is where XDR earns its license fee.
Picture a classic ransomware warm-up. First, credentials get dumped from LSASS. Minutes later, that same machine is opening SMB sessions to a dozen file servers. Handled manually, the routine is painfully familiar. Alert comes in. The analyst digs for context, pings the endpoint team on Slack, waits for an approval that may or may not come fast, logs into yet another console and only then isolates the box. At 3 a.m., four hours from alert to isolation is nothing unusual.
With a playbook, the same thing happens while everyone's still asleep:
- the EDR agent pulls the laptop off the network and leaves only the management channel open;
- the account gets disabled in Active Directory, and Entra ID sessions and refresh tokens are revoked;
- the file hash and the C2 domain are blocked on every endpoint and on the perimeter firewall;
- a ServiceNow ticket shows up with the whole timeline and process tree attached, ready for the morning shift.
About 90 seconds, start to finish. Four hours of MTTR turn into a minute and a half. Not bad, right?
Is there a catch? Sure there is. Cutting off a domain controller at 2 a.m. could do more damage than the intruder ever planned. So sensible teams sort assets into tiers. Workstations get full automation. Servers need a human to click "approve." Crown jewels? Manual only. Skip that step and the playbook itself becomes the outage.
What Global Security Operations Get Out of XDR
Global teams juggle different regions, a pile of tools inherited from acquisitions and three or four shift teams who rarely talk. XDR doesn't magically solve that.
Shift Handoffs Across Time Zones
Warsaw starts its morning, and Manila's night is already sitting in the timeline, comments and automated steps included. Nobody needs a long handover call. And nobody has to ask in chat whether someone already reset that guy's password.
Data Residency Rules and Global Visibility
GDPR has opinions on where telemetry can be stored. So do Brazil's LGPD and India's DPDP Act. Most XDR vendors handle this with regional tenants or regional data lakes, which keeps European logs in Europe while detections still show up on the global dashboard. Well, mostly. The fine print is worth a read, since some metadata has a habit of quietly leaving the region.
Threat Hunting Across Every Domain
Hunters love having one query language for everything. Microsoft's advanced hunting runs on KQL. Palo Alto went with XQL. SentinelOne has PowerQuery, and Trend Vision One just has one search bar. So a new Cobalt Strike build from Thursday's threat report gets checked across endpoints, DNS and cloud logs before lunch.
Attack Surface Management in the Same View
Some platforms now pull external exposure into the picture too. Cortex Xpanse and Microsoft Defender EASM go hunting for the forgotten stuff. That 2021 test server nobody switched off, for instance. Knowing about it changes which incident gets handled first.
XDR Platforms and Providers Worth Knowing
There's no universal winner here, and anyone promising one is, well, selling something. Mostly, it comes down to what's already running in the building:
- Microsoft Defender XDR. For shops living in Microsoft 365 E5 and Entra ID, it's the obvious pick, and the Sentinel integration comes basically for free.
- Palo Alto Networks Cortex XDR. Palo Alto firewalls already on the perimeter? Then it slots in nicely, and Cortex XSIAM can grow it into a full SOC platform later.
- CrowdStrike Falcon. Known for its lightweight agent and threat intel; Falcon Next-Gen SIEM covers broader log collection.
- SentinelOne Singularity. Storyline is the headline feature. Purple AI is the other one: analysts type hunting questions in plain English and get queries back.
- Trend Vision One. Covers a lot of ground, with sensors across email, endpoints, network and even OT.
- Cisco XDR. It took over from SecureX a while back and leans hard on network data from Cisco gear.
- DXC Technology. A services-led model, where the company integrates and operates security across multi-vendor environments, a practical fit for enterprises that can't standardize on one stack.
Then there's the native vs open XDR question. Native means one vendor end to end, with tighter integration and less tuning. Open XDR plugs into third-party tools and asks for more upkeep in return. After a decade of acquisitions, few global firms have the native option at all.
MTTD, MTTR and Other Metrics That Matter
Measure these before rollout and check them every quarter:
- MTTD, the gap between the first malicious action and the first alert;
- MTTR, split by incident type, because one blended average hides everything interesting;
- alert-to-incident ratio (if it isn't going down, correlation isn't working);
- false positive rate, since once it climbs above 40–50%, analysts start ignoring the queue;
- the share of incidents contained automatically, a decent read on playbook maturity;
- analyst hours per incident, the one number finance actually reads.
Quick reality check. MTTD went down but MTTR didn't move? Then detection isn't the problem. It's the approval chain, the playbooks or the handoff between teams.
How to Start an XDR Rollout Without Burning Out the Team
Trying to connect everything in week one is how these projects stall. The smarter move is to start with the two or three places where attacks usually begin, which for most companies means email, identity and endpoints. Get those correlating properly, automate the one response step the team repeats most, then measure. Cloud and network can wait a month.
XDR won't hire analysts. It won't write runbooks either. What it does give the existing team is one screen and one timeline, and against attackers who never worked in silos to begin with, that's a much fairer fight.
Media contact
Melanie Gorski, Corporate Media Relations
DXC Technology
20408 Bashan Drive, Suite 231
Ashburn, VA 20147, United States
melanie.gorski@dxc.com
https://dxc.com/