AV, EDR, XDR, MDR, SIEM, and SOAR: What They Are and How They Work Together

In the evolving threat landscape, cybersecurity teams must navigate a complex array of tools and acronyms. From AV to SOAR, each solution plays a distinct role yet their true power lies in how they work together.

In this article, we’ll break down what each of these security technologies does, how they differ, and how they integrate into a modern security stack with updated insight on where MSSPs fit in.

Core Definitions

What’s the Difference?

How They Work Together

A modern enterprise stack typically looks like this:

1. AV blocks known threats immediately.
2. EDR detects and responds to stealthy threats.
3. XDR correlates alerts across endpoints, cloud, identity, and network.
4. SIEM aggregates logs from all systems for centralized alerting and compliance.
5. SOAR automates response workflows, from isolating devices to notifying analysts.
6. MDR provides a managed team to monitor and respond 24/7 if internal resources are limited.
7. MSSP can manage broader infrastructure and tools like firewalls, VPNs, IDS/IPS, and SIEM.

Is Antivirus Still Necessary with EDR?

Yes. AV is still necessary, but modern EDR solutions often include AV capabilities. AV acts as the first line of defense for known threats, while EDR handles more advanced detection and remediation.

How is XDR Different from SIEM?

While both XDR and SIEM collect and correlate data, their focus and architecture differ:

Think of XDR as proactive detection and response, while SIEM is a central source of truth and long-term data repository.

What is SOAR and Where Does It Fit?

SOAR platforms automate and orchestrate detection, triage, and response actions. They connect the dots between XDR, SIEM, ticketing systems, and human analysts.

Example SOAR Playbook: Phishing Response

1. Receive alert from email/XDR.
2. Enrich with threat intel (VirusTotal, Whois).
3. Correlate with logs from SIEM and user activity.
4. Automatically:
   • Quarantine the email
   • Disable compromised accounts
   • Isolate endpoint
   • Create ticket
   • Notify security team
5. Document the entire response.

Popular SOAR vendors: Cortex XSOAR, Splunk SOAR, IBM Resilient, Swimlane.

Is MDR a Co-Managed Service?

Yes. MDR is a co-managed or fully managed threat detection and response service, built on top of tools like EDR or XDR.

Vendors like CrowdStrike Falcon Complete, Arctic Wolf, Microsoft Defender Experts, Sophos MDR, and ReliaQuest provide MDR services with ReliaQuest branding itself as “beyond MDR” with platform-based Open XDR integration and full automation.

Where Do MSSPs Fit?

MSSPs (Managed Security Service Providers) offer broader security management services beyond threat detection often including firewall management, VPN monitoring, SIEM tuning, compliance log review, and vulnerability scanning.

MSSP vs MDR Comparison:

You can think of MSSPs as full-service IT security extensions, while MDRs are focused special forces for active detection and response.

Popular MSSPs:

• AT&T Cybersecurity
• Secureworks
• Trustwave
• IBM Security Services
• NTT
• eSentire (also strong in MDR)

Security Vendor Comparison

Here’s a quick vendor landscape overview across the major categories:

Recommendations by Organization Size

🎯 Final Takeaways

• No single tool does it all. AV, EDR, XDR, SIEM, SOAR, MDR, and MSSPs each play unique roles.
• EDR assumes AV is running and modern platforms often include both.
• XDR vs SIEM comes down to scope and actionability: real-time vs record-keeping.
• SOAR ties it all together, automating triage, containment, and reporting.
• MDR is co-managed detection and response, ideal for orgs without full-time SOC.
• MSSPs offer broader managed services, often including firewall, SIEM, and compliance management.