EP82 Mega-confused by XDR? You Are Not Alone! This XDR Skeptic Clarifies!

Security.

Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here are myself, Timothy Peacock, the product manager for threat detection here at Google Cloud, and Anton Chuvakin, a reformed analyst and esteemed member of our cloud security team here at Google. You can find and subscribe to this podcast wherever podcasts are sold and distributed, as well as at our website, cloud.withgoogle.com/security. If you like our content and want it delivered to you piping hot every Monday afternoon Pacific time, please do hit that subscribe button. You can follow the show and argue with your hosts on Twitter as well, twitter.com/cloudsecpodcast. Anton, today's episode kind of started out feeling like a bit of a confessional or a therapy session for a person who seems to be like deeply troubled by XDR.

I mean, the industry is deeply troubled by XDR. If you want to psychoanalyze the entire industry, I still feel like we are all deeply troubled by XDR, provided you care. Because for me, the lack of definition, lack of consensus definition is troubling.

What is XDR?

Well, why are you asking me? I don't know.

Yeah, neither does our guest. Neither do, it seems, a lot of economic buyers out there, because people keep trying to sell it to them, and they seem to keep buying it.

Well, it's possible that there are clusters of shared definition. So, for example, if you are a buyer who believes that XDR is an improved EDR, and I'm the seller who sells improved EDR, which I label XDR, We are fine. You sell me your stuff. I need your stuff. I buy your stuff. Whether we call it XDR, that's secondary.

So then what's the problem with XDR?

Uh, the problem is that next to us in another hallway, I am buying a SIM. You're selling me XDR, and we both think that XDR is kind of a mini SIM. And what if we meet each other in a cafe or in a bar and we realize we both bought XDR, but we bought different things? That's a bit of a problem, right?

I mean, as long as it's not like matter-antimatter levels of Problem seems like it's survivable anyway, but I could see the confusion.

Yes, correct.

I think you and our guest are more worked up about this than I am, but I also have fewer horses in this fight than you two do. So maybe it makes sense that I'm a bit more sanguine.

I don't have a horse named XDR. I would never do that. I would name mine Sim.

Didn't you name yours EDR? Aren't you responsible for that horse?

ZDR? What's a ZDR?

EDR.

EDR. Yeah, yeah.

You know what?

I do have a horse named EDR. You're exactly correct. I completely forgot. It was 2013, so it's forgivable.

Ah, so long ago. Well, with that, let's welcome today's guest. I'm delighted to introduce Dimitri McKay, a principal security strategist at Splunk. Dimitri, we've talked about Splunk many times on the show. You're our first guest from Splunk. Welcome to the show.

Thank you.

Thank you.

I'm honored.

Oh, we're honored to have you. I understand you're a bit of an XDR skeptic, as are some of our listeners, and some of our listeners are XDR proponents. Give us your skeptical XDR take, please.

Okay, so I have to put context out first. So in my role, I talk to our customers and I'm a global resource. So I talk to folks everywhere and here's what's killing me.

Mr. Worldwide.

So Mr., that's correct, Mr. Worldwide. I ask the question, so what's XDR to you? And there's not a single answer that is the same. And there's a reason. It's because in my opinion, XDR is not a real thing. It's a marketing term that sort of describes subpar SIEM.

Oh.

If you could call it that.

Okay. So in your opinion—

Is that aggressive?

No, it's great.

But wait, wait, wait, wait, wait. It's great. But like, see, there are 2 camps already, at least 2 camps. The XDR as a subpar SIEM camp is going to face the XDR as an upgraded EDR camp, and they're going to have a pillow fight. And of course, what was this like Alien versus Predator? Whoever wins, evil wins. I think we're in this same bucket, right? If improved EDR camp wins, it's evil wins. If subpar SIEM wins, it's the same. So—

No, but we have to go back, like step back from this for a second. We're too close to it. It's a marketing term. Here's the reality.

By the way, what's a marketing term? Every term is a marketing term, no?

That's fair. But XDR was defined by one vendor as though it's a thing. Listen, here's the reality. Anton, you've been around as long as I have. We can talk about SIEM and the various generations of SIEM. Right. In the beginning, there was true SIEM. That was Cisco Mars. You had ArcSight, but that was SIEM 1.0. And then PCI hit, your favorite thing, PCI hit. And that was SIEM 2.0. And that's when they bolted on like a log management piece. And SIEM 3.0 was let's add ML. And SIEM 4 was let's add SOAR. So we're at SIEM 5.0. And SIEM 5.0, I think, is is worth talking about because, you know, here's the thing. XDR as a model is not that different from the old MSSPs. They had a limited set of data sources, and so they did limited correlation. But did they give customers all the data? Did they give them the ability to do any sort of forensics or root cause analysis or anything on the data? No. It was, here's a whole bunch of alerts.

Yeah.

It's an old model. It's just been rebranded from terrible MSSV to XDR by our friends at Palo Alto Networks. So I'm not convinced that it's new. But listen, I'm going to admit something.

Please. This is a safe space.

And I suspect, Anton, you have some strong opinions. I know. I'm a little passionate. We can all acknowledge SIEMs are a pain.

Yeah.

They're a pain. They're a pain to get data in. They're a pain. They are.

By the way, audience, everybody made a face. All 3 of us just made faces. Like, I mean, faces with a capital F. Oh, no cursing. Sorry.

So SIMs are a pain. Go on with your confession, please. We're here for you.

SIMs are a pain, and creating detections is a pain, and Karen feeding is a pain.

Yeah.

And I, and I get it. Like, the SMB market looks at XDR and they go, wait, so everything just kind of works? Because that's what's being sold to them. Oh, everything just works.

Does it?

Not really, but okay, we'll go with it. But I think we have a problem there. And that SIM is hard. And a lot of companies don't have the people, they don't have the resources, they don't have the time to roll out a full-on SIM. But I feel like XDR is BS. They're marketing something that's not real.

So you kind of feel about this the way I feel about cryptocurrency. Like, I look at the crypto market as it's being sold to everyday people, and gosh, it's really tough for people to get ahead these days. And crypto promises 200% returns overnight. But what they're being sold is a crock. So is that how you feel about XDR? You know, people have a real problem, they're really struggling, but this isn't the answer?

Yes, that's about right. And I hate that everyone's jumped on this XDR bandwagon. I mean, I scratch my head and I say, okay, well, let's look at Gartner because I'm going to take a shot at Anton. Let's look at Gartner. Where's the XDR quadrant?

MQ?

MQ, exactly.

Is there one?

I haven't seen one. So is it really a thing?

Does having an MQ make it a thing, though? Should we really let Gartner have that power? Anton, should Gartner have that power?

It's the opposite, though.

Should anybody have that power?

But should we let Palo have that power?

Um, Gartner gets a crayon and draws an MQ-shaped circle around something that exists. So generally speaking, no MQ kind of means that the thing doesn't truly exist. It may be emerging. And there is research, of course, published by Gartner and Forrester and others that describe the thing that's emerging. The problem is that they don't agree between themselves, including some analysts, to the best of my knowledge, within a firm may not agree with each other. So, it's interesting how we are kind of circling around the same point, but something gave birth to this desire. And I don't think— I do not, honestly, I don't think it's just vendor greed. So there was some kind of motivation. And I think Dmitri's point about SIEM being hard, maybe one half of it, maybe there are others. EDR expanding to other domains, maybe another. But if you have to argue pro-XDR in the sense that this idea appeared, why did it appear? Was there anything logical behind it? Is it that detection is hard? Is it that SIEM has bad usability? Can you maybe talk about this a little bit?

So if we look at EDR, what is EDR? EDR is the evolution of endpoint protection. It's the evolution of antivirus.

That's a pretty vile opinion from my point of view because endpoint protection is antivirus, and EDR is not an evolution of antivirus. EDR is a detection and response tech.

But think about it. We're still talking about protection of endpoints, whether that be active or reactive. It's still focused on the endpoint in an attempt to protect it from various threats.

Yes.

Can we agree on that?

For sure. For sure.

And antivirus was the beginning, and then EDR was the— is basically the evolution of that, where it was just a response to signatures and algorithms that checked the files to see if there was any weirdness.

Static analysis? Not necessarily.

No, you had static versus basically the dynamic analysis of files. Yeah, but that was antivirus. And EDR basically just said, well, you know what? Let's do a better job of that, and let's actually add the ability to do proper response to it. And that to me is— that's evolution. But XDR is not an evolution of EDR. EDR is a data source that comes from endpoints, right? It's software that runs on endpoints and we grab data from that.

Okay, but the SIEM vendor would see EDR as a data source. That's your worldview cone from where you sit.

Correct.

For some people, EDR is much more than a data source.

I agree with that. It's a tool.

It's a tool.

Like, at the end of the day, these are all tools. And to say I'm biased, you're right, there is bias. But also understand, in my role, I don't talk product.

I don't mean to call you biased. I mean to say you have a perspective.

No, no, no. We're all biased. I agree with you. Yes.

100%. Well, yeah, there's bias. Yeah, of course there's inherent bias.

But the point I'm making is, holistically, yes, EDR is— it's a tool. And here's the thing. I love EDR. I love EDR because if we look at how breaches happen, they happen on endpoints. That's where they start. It's phishing email to get access to endpoint and then pivot from there. So EDR has a ton of value. And the truth is, when we look at, were customers looking at that in the past? No, they were focused on the crispy outer layer. They weren't looking at the soft, sultry inner layer. So that's evolution too.

But so to summarize your point of view, you're kind of saying that in this model of the world, there's absolutely no redeeming quality behind the XDR concept in your mind. It's basically kind of a simpler support which should just be called SIEM, or what? What about the endpoint visibility? What about the deeper endpoint visibility of XDR?

But it's just data. So if we're talking about a SIEM, EDR is viewed as just a data source, whether it be the alerts, whatever it is, it's just a data source. But if we look at XDR, what is XDR? We've got detections.

Well, we don't know. That's the point.

You know what? Let's do this a different way, right? So let's think of it this way. We go, okay, what are the components of SIEM? You've got correlation, you've got automation, you've got detection.

Collection.

Log management.

Ingest.

Maybe some ML ingest. Yep. Okay. So we have, let's say it's 6 components, right? Now, if we look at XDR, what are the components of XDR? You've got detection, you've got ingest. Do you have log management? No. Do you have ML? Maybe.

ML, yes. Log management sort of as filtered, strongly filtered log management is there sometimes for some XDRs, right?

No. Log management is a bucket that everything goes into. ML is the ability to pull from that relevant information over time, looking for deviations from norm, et cetera. But the point I'm making is, XDR is— if you don't have all the pieces to be an actual SIEM player, if you only have a couple of them, then you market something called XDR because you can't compete with the SIEM vendors because you don't have all the pieces.

Hmm.

And we're seeing that, you know, XDR, cloud XDR, MSSPs pushing XDR. It's because of the same thing. They don't have all the components. to call them a SIEM. So they're marketing something that is not a SIEM because they don't have all the pieces of a SIEM, but they want to compete against the SIEMs. And I find it ludicrous.

But wait, wait, wait. If I believe some analysts, they compete against EDR quite a bit. I mean, Forrester, my sort of colleagues from Forrester would tell us that most people who buy XDR are buying them to replace EDR, not to replace a SIEM. So in that sense, it looks like there's a disconnect between vendors and customers. vendors in your mind are competing with SIEM, but customers are buying XDR to replace EDR. How do you explain this one, if you do?

But I never see that. What I see is— here's the thing. I get pulled in for the strategic conversation. The strategic conversation often comes down to, well, we're looking at XDR instead of SIEM.

What?

Like, there's never a mention of we're going to replace EDR with XDR.

That is fascinating.

Because we're still talking about Correlation across multiple data sources. It's still correlation. It's detections, detection response, the 2 magic words in EDR, detection response, XDR, detection response, right? But it's still just detection response. What do SIEM— what does the SIEM do? Detection. What does the SOAR market do? Response. What is SIEM 5.0? Detection response, but with more data sources.

Hmm. I feel like maybe we are exposed to yet another part of the elephant from the old parable, right? Like, for example, I sort of assumed that my analyst colleagues told me that people are buying XDR mostly to replace EDR, but your data point indicates that people are buying XDR to replace a SIEM, right?

Or versus a SIEM.

Or versus a SIEM, correct.

Yeah, they're looking at them as being one of the SIEM. Exactly. But here's the question. So in your opinion, Anton, as a former analyst, do you see XDR as the evolution of antivirus and XDR being the evolution of EDR? Because we're going from endpoint, the E in EDR.

I'm all confused. I don't have an opinion on this one.

Yeah.

I mean, I'm not joking, by the way. If you've read my blog posts on this, I'm like, I have no idea. I don't have a stake in the ground. I think that, as we say in the questions to ask you, There are 2 camps, XDR is EDR plus, and XDR is a SIEM minus. Well, not exactly minus, but kind of simplified, more integrated SIEM, but ultimately minus in terms of breadth of functionality. So which camp is right? I have no idea. Don't look at me.

Yeah, he's not an analyst anymore, remember? He's not guilty of that anymore.

Yeah, exactly. Thank you, Tim, for saving me.

No, no, I think maybe what would be interesting is to get away from the confession box here and talk about cloud, because this is a cloud security podcast. Cloud XDR is something that I, I've spent some time talking about, and there's certainly challenges using SIEM of any number dot O in the cloud right now, just given all the things that are different with cloud and data volumes. So if we want to do good DNR in the cloud, and I think we all agree we all need good DNR for our cloud surface, what does the future look like there? Is it going to be SIEM for cloud DNR?

I mean, so it's a good question, and I have bias here.

Thank you.

You're welcome. So, you bring up a good point because here's the thing. If we look at how many cloud vendors customers have, it's 25+, I think is the average, different cloud vendors that they're using, and that's not decreasing. So, yeah, I mean, I think that the cloud vendors would love to You know, the folks like Google Cloud, Azure, AWS, they would love to keep everything within their ecosystem, right? It makes them more sticky. I get that. But the challenge is, to your point, what about customers who have multiple— are using services from all the various clouds?

Yeah.

The bias I have, of course, at Splunk is that we'll take anything. But what does the future look like? Well, that really, it's up to the customers. Because if we look at the history of really any product, locking people in is not a great strategy. And the challenge that I've been finding with customers is that they end up with 3, 4, 5 different SIEMs because they've got their data over in Azure, they've got Google and GCP— excuse me, data in GCP. They've got data all over the place, some legacy SIEMs, and they're scratching their heads, too, going, well, now what do I do? Because investigations take forever, because compliance takes forever. And the sheer operational cost, not even just support, not even just education, but just maintaining that, it's a massive undertaking.

So how do we help? I think we all agree on the problems. How do we help?

Yeah. Not by selling yet another tool category, right? Because the whole CDR—

And not by shaking our heads.

Yeah, that's true. And not by saying, Now you have to buy a CDR.

What's a CDR?

Cloud Detection Response, a new category I just made up, right? So we have to sell everybody.

Oh, when I hear CDR, I get flashbacks to like, and this is going to age me, I get flashbacks to burning CDs in elementary school. That's what I think of.

And of course there's already a security acronym called TDR.

But so what are we going to do, Dmitri? How do we help? Because we agree there's problems. You don't like one solution. How are we going to help?

Well, I think as an industry in the SIEM industry, I think there's a couple things happening is we need to see consolidation. And when I say that, a trend I am seeing also in mature security programs is that people are consolidating the toolsets they have because lots of folks bought basically a product looking for a feature. I think SOAR is a great example of that.

Hmm.

They bought a feature. But if we look at the consolidation of, even in the SIEM world, consolidation of the various tools as we go through the SIEM 1 through 5. It was adding additional functionality, but, and I think Microsoft, I think Google, and I think Splunk, they're all on the same trajectory, which is add features to the various tools that they offer, but consolidate it so it's more of a single view, a single UI across a big feature set, but simplify it. I know at Splunk, you know, one of our goals has been to help customers get out of the research and development business. and all the operational work involved in a SIEM and try to reduce the amount of R&D that folks have to do. So give them content that's relevant to today's threats. And I think that's the trend that we're all going towards, which is make it easier. Like my father used to say, keep it simple, stupid.

Make it easier. That's interesting. So you're saying we can help by providing pre-made meal kits instead of providing a produce aisle?

Well, here's the thing is, How many tools out there, and I think everyone's guilty of it, Splunk is certainly guilty of it, is offering a toolbox. And if we look at the adoption curve of any product or any, yeah, any product, you go up into the right, right? If you want to follow Malcolm Gladwell or you want to do Geoffrey Moore, it's the same either way, but you've got adoption categories.

Malcolm Gladwell is my least favorite major public author.

He's got good hair.

He does.

Is his book going into resources or not?

No, no, no, over my dead body.

Wouldn't this be the tipping point? Should I just start throwing out Malcolm Gladwell books?

You're going to be the outlier of the episode we don't release.

Well played.

No, we'll just nudge you to not say it anymore. Okay, that's fine.

But no, no, no, back to what we were saying. How do we help?

Content.

But that's the thing is imagine a sim where we didn't have all of the pain that came with sim, the pain of onboarding. Every sim has onboarding pain. Every sim has content out of the box that is just noise. Every sim requires a ton of care and maintenance and education. Listen, we have to simplify this.

Wait, wait. Hey, wait, wait. Stop. I need to stop him because he mentioned most sims have content out of the box that's just junk, which, by the way, Tim, is my side of our argument. So Tim and me have this multi-year, multi-month argument about default content. And I think Dmitry just voted for my side, namely that out-of-the-box content is junk.

You're only hearing that part of what he said. 30 seconds before that, people need content that just works. They don't want another toolbox. They want their problems to be solved. So I think Dmitry is arguing for good out-of-the-box content, not crappy out-of-the-box content.

Oh, well, I think we need to look at this both ways. So the crappy out-of-the-box content—

That's a biased view.

Oh, of course it's biased. But out-of-the-box content, like the stuff that comes out of most sims, is great for customers who have nothing. Or at least that's what it's been. But we need better out-of-the-box content. We need content that's relevant to today's threats. Listen, if we look at the metrics, we're still getting too many alerts in the SOC. We still have a problem with hiring people that can push through them, and we still have an average of 16 to 20 cases that an analyst can get through in 8 hours. This is the reality. We have to make this easier. We have to make the content better. And not just detections, but All of it. Onboarding content, the detection content, the response content needs to be easier.

All of it.

People want answers to questions. They don't want another toolbox.

But wait, so for the cloud, then, it sounds like you're arguing— to kind of bring it back to the question— it sounds like you're arguing that a SIEM platform is a better answer for cloud detection compared to, A, a separate tool called CDR or whatever else, or somewhat confusing category called XDR. You're kind of suggesting that ultimately, if you have one platform that does this, you should expand this platform to cloud. Is this a bigger part of your question or your answer or not? Because I have a counterpoint to this point.

No, no, I love the idea of a SIEM in the cloud. Is it owned by Google? Is it owned by Microsoft? Is it owned by Oracle? Who knows, right?

Right. No, it's a separate story. The point is that it's the same SIEM.

But being cloud, yeah, I love the idea of reducing the current feeding and all the Pain of standing up a SIEM. And if that could be made easier in the cloud, 100%, I love that. I love it. And especially it makes it easier to onboard data because let's be honest, more people are bringing on cloud data sources, less people want to manage data centers. So that's this direction we're going and getting data from cloud sources is a heck of a lot easier because the format doesn't change every 6 months when there's a release.

Isn't that nice about cloud?

There's some huge benefits of cloud.

But I mean, to again bring it up to the question we sort of asked, if you have a choice of buying a separate tool or buying a new tool or incorporating cloud telemetry into a SIEM, you would choose integrated into a SIEM. If you have 3 architectural choices, use the same SIEM I have, choice 1, buy a separate SIEM for cloud, choice 2, or buy some kind of a mythical CDR tool, choice 3, you would say choice 1 is the right choice, using the same SIEM you have.

Well, it depends on where your SIEM is. If your SIEM is on-prem and that's working for you, keep it up then. But a SIEM in the cloud, to me, makes way more sense.

Yeah.

But I don't like the idea of— so here's the thing. I was talking to a customer the other day and they said, oh, we're 100% Microsoft shop. Everything we have is in Azure. Oh, okay, cool. Do you use ServiceNow? Yeah. Do you use Salesforce? Yeah. We went right down the list of— and it turns out they have 15 different cloud vendors, not just Microsoft. And so the question I started asking was, okay, but what about if tomorrow you decide you want to start using some Amazon services? Because not all clouds are created equal. What if you want to just start pulling in, I don't know, there's some services over in Google, there's some services in AWS that you want to start using? Then what? Because you have everything, as you said, you're, you know, one cloud vendor. What if you acquire another company and they are a 100% AWS shop. How does that work? How do you secure them? Are you going to maintain multiple SIEMs? You need to have a platform, in my opinion, that is going to give you choice, that has that flexibility. And there's a couple out there that do.

But single platform to you is the right choice, right? It's not like, for example, I would say, you have a SIEM for your on-premise, but my SIEM, whatever that is, is better for cloud, and I want to try to sell it to a client, and you'll use 2 SIEMs. To me, this is not a very logical situation, right, of having 2 SIMs.

Yeah.

But ultimately, I'm trying to push you to an answer that, yes, if I have a SIM and it more or less works for the cloud, that's the right choice. Because I think that that's what you're saying, but not quite saying.

No, that is what I'm saying.

If I have a SIM and it mostly works, and now I'm in the cloud, can I keep using it? Should I keep using it?

If you have it in the cloud, yes.

Yeah, yeah. But form factor matters as well. Like, it better be— if you have an on-premise SIM, it's unlikely to be a great fit for cloud. This part I get, yes.

Well, I mean, listen, you can go grab cloud data while on-prem.

Mm-hmm.

Here's the thing is, we got a ton of folks out there who are just— they're happy to move some things to cloud, but they're still not moving everything. They still have requirements. They still have, you know, those expectations, and they're not willing to move yet. So your on-prem SIEM should be able to go and grab stuff from cloud. That shouldn't be a problem at all. But the thing I always push back with is, if you're given a choice today of you're going to roll out a SIEM, Do you do it on-prem or do you do it in cloud? I always vote for cloud.

No, don't do it on-prem. That part is very clear. Yeah, yeah, that part is very clear. No, that makes sense. And I think we're close to time. So I wanted to ask our standard closing questions, which are any recommended reading from you? Of course, I'll add my own blogs on XDR simply because I'm a self-serving bastard, but like any other reading on this? And of course, the other part of our closing question is, One tip to people who think they need XDR.

Let's see. Recommended reading. God, I've got a huge bookshelf of books.

I mean, Splunk blogs is fine. You know, anything is fine. You know, here we are not biased at all.

Yeah, I mean, Splunk Security Blog is pretty good. The search team puts out some great content. I'd check there. But I'm also a big fan of all of the industry stuff. So I'm a big fan of Red Canary's latest PDF that they put out. The Verizon DBIR, the new one is out. I love that.

Yeah, they have a security report. Yeah, yeah, yeah. A tip to people who think they need XDR. Initially, I thought about asking you for a tip to XDR buyers, but ultimately, in your opinion, nobody should buy it. So, a tip to people who think they need XDR. What should they think of?

Well, just understand your requirements. If your requirements include you want to do full investigations or compliance, keep in mind that oftentimes that'll be a challenge. So, understand what your requirements are upfront and make an informed decision. But don't just shoot from the hip because you have a couple of products from the same vendor.

Perfect. No, that's— focus on requirements is very much what I used to tell people when I was an analyst. So thank you very much for this. And again, Dmitry, thank you very much for being on the podcast.

Thanks for having me. This was fun.

And now we are at time. Thank you very much for listening and, of course, for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcast. Your hosts are also on Twitter at Anton_Chuvaikian and TimPico. Tweet at us, email us, argue with us, and if you like or hate what we hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode.

Security.