XDR · SIEM · SOAR · cases
One platform for logs, endpoints, alerts and cases. AI does the first pass and explains itself. A person decides. Runs on your servers, or ours.
Facts, not benchmarks. Throughput and storage depend on your telemetry mix; see the sizing table in the docs.
Telemetry in
One platform, three jobs
A SIEM that does not know your endpoints. An EDR that does not know your logs. A ticket system that knows nothing at all. XenXDR replaces the duct tape with one platform where every part shares the same data.
Every log from every source, searchable in one place. Saved views your analysts keep, and a one-click jump from any alert to the exact evidence behind it.
A lightweight endpoint agent. See what is happening on any host, cut it off from the network, stop malicious processes and collect evidence remotely.
When an alert becomes an incident, the case opens itself: notes, evidence and indicators carried over, nothing retyped. Track every investigation from first alert to final report.
The console
Monospaced, keyboard-first, quiet. The console shows the number and the timestamp and gets out of the way.
Every field has one canonical name and a description. The query bar suggests both.
Volume over time first, the documents second. Expand any row for the fields, or jump to the raw event.
Ask a question in plain language. The hunt runs bounded, read-only queries and shows you what it ran.
AI inside
Most alerts are not incidents. They are noise that burns out good analysts. XenXDR works through that queue the way your best analyst would: gather context, check the pattern, write up what happened. Your team keeps the interesting work and the final say.
Each new alert runs through the workflow you attached to its detection, around the clock. Nothing sits unread over a weekend.
Related activity across hosts, users and network is pulled together and laid out as a timeline before a person opens the alert.
A plain-language summary, a suggested verdict with confidence, and a grade for how much of the evidence is actually about this alert.
Recurring benign patterns close automatically, but only under a policy you set, with the full trail kept and reversible.
A detection matches, from the shipped content pack or the rules your team brings. Duplicates fold into one alert.
The attached workflow enriches, correlates and reconstructs what led to what, using bounded read-only queries.
Benign, malicious or needs a person, with confidence, a recommendation and the evidence grade behind it.
Architecture
Everything you send, from endpoints, firewalls, cloud identity or scripts, flows through one pipeline into one store. Alerts, cases and response all see the same picture.
Telemetry in
The spine
Acting on it
Capabilities
Search your whole environment in seconds. Saved views, keyboard control, and a straight jump from any alert to the evidence.
Start with the shipped rules, then make them yours. Import Sigma directly; write query, sequence and correlation rules natively.
A queue your team can manage: list or kanban, SLA timers, assignment, tags, and related alerts grouped into one story.
Escalation carries notes, evidence and indicators automatically. Timeline, tasks, war room and hand-offs in one workspace.
Act on any endpoint remotely: browse files and processes, isolate a machine, collect evidence, open a live shell.
Every enrolled endpoint visible with presence, health, risk score and the security tools it should be running.
Automate the routine: attach workflows to detections, run them staged or automatically, review every run.
Serve many organizations from one deployment with strict data separation, per-customer access and audit.
Who it is for
Replace a pile of consoles with one, without handing your data to someone else's cloud.
Run all your customers from one deployment you control, with a portal each of them can log into.
Our SOC in Gdańsk operates XenXDR for you: monitoring, triage, response and a monthly report.
Deployment
XenXDR is self-hosted by design: a single Linux server, automatic TLS, and open data your ops team can inspect for itself. Your data stays on your infrastructure.
A box with 4 vCPU, 16 GB and NVMe storage covers roughly 200 endpoints. The docs have the full sizing table.
$ git clone https://github.com/fluencesecurity/xenxdr-deploy && cd xenxdr-deploy $ cp .env.example .env && ./scripts/gen-certs.sh ingest.xdr.example.com ✔ ingest CA and server certificates written $ docker compose up -d --build ✔ platform healthy ✔ console · portal running ✔ TLS issued for console.xdr.example.com $ open https://console.xdr.example.com
Security posture
We hardened XenXDR before asking anyone to run it. Here is how.
Data residency, the disclosure policy and procurement answers are on the security page. Security and trust
Early access
XenXDR is a feature-complete platform, security-hardened, and we are onboarding design partners: security teams and MSSPs alike. Self-host it with your team, build your managed offering on it, or let our SOC operate it for you. Either way, you will be talking to the people who build it.
FAQ
The platform is commercial and built on open standards: ECS-compatible fields, Sigma rules, and syslog, Beats and HEC inputs. Your data stays in formats you can inspect, query and export.
On your infrastructure, full stop, when you self-host. Your telemetry stays with you. If you prefer a hosted tenant, it runs on a dedicated deployment under the xdr.fluencesecurity.com domain.
The optional AI verdict step sends evidence only to the model endpoint you choose; with a model on your own hardware, everything stays inside the deployment.
Only when you allow it. The AI's verdict is advice. Automatic close or escalation happens only when you enable it for a specific workflow and the verdict is clear-cut. Everything else waits for a person, and every action is audited. With no model configured, triage runs on built-in deterministic logic.
The agent runs on Windows 10 and 11, Windows Server 2016 and later, and Linux (amd64 and arm64) as a system service. It connects outbound only and installs without a reboot. Other systems, including macOS, send their logs by syslog or Beats.
It complements it. The agent collects telemetry from the sources your endpoints already produce, such as Sysmon, the Windows Event Log and auditd, brings in your endpoint protection's detections, and acts on the host when a detection fires: isolate, kill, block, collect.
Yes. XenXDR imports Sigma rules directly, staged for your review before anything fires. Subsets of KQL and EQL are supported, and native rules can express query, sequence and correlation logic.
Yes, that is a first-class use case. One deployment serves many organizations with strict data separation, per-customer access for your analysts, per-tenant SLA policy and automation ceilings, and a portal each customer can log into.
We price per environment, not per gigabyte, and early-access pilots are scoped individually. The pricing page explains the three ways to buy and what each includes. Ask us and you will get a straight answer.
A 30-minute walkthrough on fictional data, then a pilot in your environment. No slides, no pressure.
