Detection & Response

Pick the first of two products.

Open a name for its full profile

Microsoft Sentinel
Capabilities only
Microsoft · Commercial · 7 capabilities in this domain
Select
Splunk Enterprise Security
Capabilities only
Splunk · Commercial · 6 capabilities in this domain
Select
Google Security Operations
Capabilities only
Google · Commercial · 5 capabilities in this domain
Select
CrowdStrike Falcon Next-Gen SIEM
Capabilities only
CrowdStrike · Commercial · 4 capabilities in this domain
Select
Elastic Security
Capabilities only
Elastic · Freemium · 4 capabilities in this domain
Select
Microsoft Defender XDR
Capabilities only
Microsoft · Commercial · 4 capabilities in this domain
Select
CrowdStrike Falcon Complete
Capabilities only
CrowdStrike · Commercial · 3 capabilities in this domain
Select
Panther
Capabilities only
Panther Labs · Commercial · 3 capabilities in this domain
Select
Microsoft Defender Experts for XDR
Capabilities only
Microsoft · Commercial · 2 capabilities in this domain
Select
Tines
Capabilities only
Tines · Freemium · 2 capabilities in this domain
Select
Wazuh
Capabilities only
Wazuh · Open Source · 2 capabilities in this domain
Select
Sigma
Capabilities only
SigmaHQ · Open Source · 1 capabilities in this domain
Select

In Detection & Response

Microsoft Defender XDR

Microsoft · Detection & Response

CommercialCompany

Defender XDR stitches alerts from Defender for Endpoint, Identity, Office 365 and Cloud Apps into incidents with automatic attack disruption and cross-domain advanced hunting in the Defender portal.

What it does4 capabilities · 4 at full coverage

4 of 4 at full coverage.

Automated Investigation & ResponseFullDR · level 4 · 4 providers
Extended Detection & Response CorrelationFullDR · level 3 · 2 providers
Real-time Threat DetectionFullDR · level 3 · 5 providers
Threat HuntingFullDR · level 4 · 10 providers

What it proves12 controls across 3 frameworks

Satisfied through its capabilities, not claimed by the vendor.

CSF 2.010 / 106DE.AE-02 DE.AE-03 DE.AE-04 DE.AE-07 DE.CM-01 DE.CM-09 ID.RA-03 RS.AN-03 RS.MI-01 RS.MI-02
AICM1 / 18LOG
CIS Controls1 / 18CIS 13

What it stops10 techniques

10 techniques countered, 10 of them common

Application Layer ProtocolT1071Very Common
Boot or Logon Autostart ExecutionT1547Very Common
Command and Scripting InterpreterT1059Very Common
Data Encrypted for ImpactT1486Very Common
OS Credential DumpingT1003Very Common
Obfuscated Files or InformationT1027Very Common
PhishingT1566Very Common
Process InjectionT1055Very Common
Remote ServicesT1021Very Common
Valid AccountsT1078Very Common

Where it runs2 phases · 1 way to deploy

Capabilities per lifecycle phase

Operate1
Monitor4

How it is delivered

SaaS

What it unlocks2 activities · reaches level 4

Program activities its capabilities support, reaching level 4. Supporting an activity is not completing it.

Level 3

Real-time detection with automated responseHigh effort

Level 4

Detection engineering as code and threat huntingHigh effort

How it holds up2 strengths · 1 limitation

Strengths

Cross-domain correlation for Microsoft workloads
Automatic attack disruption

Limitations

Value depends on deploying multiple Defender products

What it costsPer user subscription

LicensingPer user subscription

Priced peruser per month or year

BillingSubscription

Scales withNamed or licensed users

Total cost

Bundles such as Microsoft 365 E5 spread cost across many products; value depends on actually deploying the included capabilities.

What it takes to runStaffing, standing it up, and what it promises

False positives3% typical

What it works with1 integration

Integrates with

Microsoft Sentinel

What else to look at7 siblings

Same family

Microsoft Defender Experts for XDRCommercial
Microsoft Defender External Attack Surface ManagementCommercial
Microsoft Defender for APIsCommercial
Microsoft Defender for EndpointCommercial · 4.18
Microsoft Defender for Endpoint Plan 1Commercial
Microsoft Defender for IdentityCommercial
Microsoft Defender for Office 365Commercial

What backs this up

No measurement, incident or pipeline using it.

Gantry 7.1.0 · OFF.12 · OFF.13