New CrowdXDR Alliance Defines Data Exchange Standard for XDR

The companies behind the push for the eXtended Detection and Response trend are promising enterprise security teams there’s a way to unify different endpoint, cloud, and network security tools to get visibility over their security vulnerabilities, risks, and defenses. However, if the tools can’t speak with each other and share the data, the integration is limited and defenders wind up with too many alerts to deal with.

That is the push behind the CrowdXDR Alliance, a partnership between CrowdStrike and other software-as-a-service, cloud, and security companies to establish a common language for data sharing between security tools and processes. At launch, Google Cloud, Okta, ServiceNow, Zscaler, Netskope, Proofpoint, Extrahop, Mimecast, Claroty, and Corelight have joined the coalition.

The lack of standards for data sharing across different security platforms means enterprise defenders can’t use all the data at their disposal for their investigations. The partnership will establish and support a standardized XDR schema to share relevant telemetry and accelerate incident response with contextually enriched detections, more effective correlations, timely investigations, and automated responses.

The shared schema for XDR data exchange will enrich endpoint detection and response (EDR) data with relevant, vendor-specific security telemetry, CrowdStrike says.

“XDR, like SASE and Security Services Edge (SSE), is critical to security transformation and a non-negotiable need for enterprises moving to cloud infrastructure,” Netskope CEO Sanjay Beri said in a release.

CrowdStrike also announced its Falcon XDR, which extends its EDR (endpoint detection and response) capabilities to “deliver real-time detection and automated response across the entire security stack.”

In other XDR-related announcements: