One pipeline, one store
Every event XenXDR receives flows through one pipeline into one store. Alerts, cases, response and reports all work from the same data, so an investigation never has to stitch modules together.
telemetry in XenXDR acting on it
───────────── ─────────────────── ────────────────────
endpoint agents ─┐ ┌─ detect: rules, correlation
syslog / CEF ─┼─▶ normalise ─▶ one store ─┼─ respond: playbooks, AI, SLA
HTTP JSON / HEC ─┤ ├─ console: analysts
cloud connectors ─┘ └─ portal: customers
What a deployment gives you
| Capability | What it does |
|---|---|
| Ingest | Accepts Beats, syslog, HTTP JSON and Splunk HEC, normalises every event into the canonical schema, keeps the original document, and flags anything it cannot parse on the Logs page. |
| Connectors | Pull from cloud sources such as Okta and Microsoft Entra ID, with lag reported per source. |
| Endpoint fleet | Agents connect over TLS; commands from the console reach the host and results stream back. |
| Detection | Runs rules on their schedule, writes alerts, and clusters related alerts into correlations. |
| Response | Runs playbooks, the advisory AI, SLA measurement, scheduled reports and notifications. |
| Console | The analyst workspace. |
| Customer portal | A separate application on its own hostname for the organizations you protect. |
Data flow for an alert
- A source sends an event. XenXDR normalises it and stores it with the raw document alongside.
- On its next pass, a detection rule matches the event and writes an alert. Duplicates within the rule's window fold into one alert.
- The playbook attached to the detection runs: enrichment, correlation, optional AI investigation, an advisory verdict.
- The alert appears in the queue with its verdict. Depending on the playbook mode, responses are staged for a person or executed automatically within the organization's ceiling.
- An analyst works the alert, closes it or escalates it to a case. Every step lands in the audit trail.
Tenancy
Organizations are the tenancy unit. Every event, alert, case, host and ingest key belongs to exactly one organization, and every query in the console is scoped by the analyst's grants. See Organizations.
Connections
Agents and log shippers connect outbound to the deployment, so endpoints need no inbound firewall rules. The deployment's own outbound connections are the ones you configure: pull connectors, a model endpoint, enrichment services, notification channels and update downloads.