SIEM vs XDR is a question of scope: a SIEM collects, centralizes and analyzes log data from almost any source for detection, investigation, compliance reporting and long-term retention, while XDR correlates detections across a vendor’s own endpoint, identity, email, cloud and network tools (plus supported integrations) and takes built-in response actions. SOAR automates response through playbooks, usually on top of a SIEM. As of October 2026 the categories overlap, with several large vendors selling platforms that combine them.
More security operations coverage is listed in Enterprise Techie’s topic index.
In this guide
Key facts
| Term | What the source says | Source |
|---|---|---|
| SIEM | Collects, centralizes and analyzes log data for cyber security; alerts on anomalies | ASD’s ACSC and CISA (2025) |
| XDR | No NIST definition; vendors describe cross-product detection and response | NIST glossary; Microsoft Learn |
| SOAR | Automates response with predefined playbooks; usually not suited to immature environments | ASD’s ACSC and CISA (2025) |
| SIEM pricing | “Most SIEM pricing models are based on the quantity of logs ingested” | ASD’s ACSC and CISA (2025) |
| US federal log retention | Searchable for 6 months, retrievable for 1 year | OMB M-26-14 (May 2026) |
What SIEM, XDR and SOAR do
The NIST glossary, quoting SP 800-92 (2006), defines SIEM software as “a program that provides centralized logging capabilities for a variety of log types.” The 2025 SIEM and SOAR practitioner guidance from ASD’s Australian Cyber Security Centre, CISA and partner agencies adds the analysis: a SIEM applies a baseline of business-as-usual activity, rules and filters to correlate logs and alert on activity that may be an incident. SP 800-92 notes that SIEM products support “several dozen types of log sources” and follow no SIEM-specific data standard.
XDR has no NIST definition; the glossary lists it only as an abbreviation, so vendors supply the meaning. Microsoft describes Defender XDR as a suite that “natively coordinates detection, prevention, investigation, and response across endpoints, identities, email, and applications,” using signals from the Microsoft security products a customer has licensed. Cortex XDR connects endpoint, network, cloud, identity and email data, per Palo Alto Networks. Cisco XDR also accepts detections and telemetry from third-party products, though integrations other than threat intelligence and IT service management require its Advantage or Premier tier.
SOAR, in the ASD and CISA definition, “automates the response to anomalous activity detected on a network” by applying predefined playbooks. Some collect logs themselves, others rely on a SIEM, and either kind can connect to firewalls, endpoint tools and vulnerability scanners.
Data model and retention
A SIEM ingests logs from whatever the organization connects: operating systems, network devices, SaaS audit trails, applications and often the XDR itself. Retention is a configuration and budget decision. Microsoft Sentinel keeps ingested data at no charge for the first 90 days and offers a lower-cost data lake tier for longer retention; Google Security Operations packages include 12 months of hot retention.
An XDR stores its own sensor telemetry and the incidents built from it, on the vendor’s terms. Microsoft documents that Defender XDR data is retained for 180 days, while advanced hunting reaches 30 days of raw data “unless it’s streamed through Microsoft Sentinel.”
ASD and CISA recommend a “data lake or repository-first approach” where the SIEM draws from a log repository, and say a SIEM should not be used primarily as a log centralizer. CISA’s Logging Reference Architecture (August 2026) says SIEM-first designs often become “costly and less flexible as telemetry volume and retention expectations grow.”
Compliance logging: where SIEM retention matters
Retention is where XDR alone usually falls short. For US federal agencies, OMB memorandum M-26-14 (May 22, 2026) rescinded M-21-31 and its event logging tiers. Its baseline requires logs to be “actively searchable” for at least 6 months and retrievable for a year. Storage may be decentralized if the top-level SOC can reach the logs, and enterprise SIEM software is one listed option.
Outside government, ASD and CISA suggest organizations new to detection start at a minimum of one year for administrative and security logs and 90 days for informational logs, adjusted for risk and regulation. The UK NCSC’s logging guidance recommends keeping incident-relevant logs for at least 6 months. NIST’s SP 800-92 Rev. 1, still an initial public draft from October 2023, lists GDPR, HIPAA and NERC among the sources of logging requirements.
ASD and CISA also warn against overbuying: if compliance is the main driver, a SIEM “might not be the most appropriate or cost-effective option,” and CISA’s free, open source Logging Made Easy targets small and medium organizations. Set log retention alongside the backup retention policy so the two schedules agree.
Detection approach
The UK NCSC’s SOC guidance separates commercial tool detection, where vendor analysts maintain the rulesets, from custom detection use-cases, which are rules a SOC writes for its own environment and are “typically implemented in SIEM tools.” Vendor rules are “biased towards techniques that benefit the widest range of customers”; custom rules rely heavily on skilled analysts.
XDR leans on the first model. Microsoft’s automatic attack disruption uses Microsoft researchers’ insights and AI models to correlate signals at the incident level, though Defender XDR also supports custom detection rules. A SIEM depends on the second. ASD and CISA say a SIEM baseline takes “at least several weeks” to build, and the event logging guidance they published with international partners in 2024 recommends user and entity behavior analytics.
Response actions
XDR ships native response. Microsoft’s attack disruption can contain or isolate a device, contain an IP address, and disable or contain a user, and the security team can undo every automatic action. Cisco XDR can trigger controls in integrated products, such as blocklisting a file hash.
A SIEM mainly alerts and supplies evidence, though SP 800-92 notes it can initiate responses “if desired,” and many bundle automation, such as Sentinel playbooks built on Azure Logic Apps. Dedicated SOAR goes further: ASD and CISA list system quarantine, blocking network traffic and credential revocation as examples.
Cost drivers
- SIEM ingest: ASD and CISA say most SIEM pricing is based on logs ingested and that uncapped licenses risk “very significant costs.” Microsoft bills Sentinel per GB, pay-as-you-go or by commitment tier; Google says Security Operations packages are “based on ingestion”; Splunk offers activity-based, workload or ingest pricing for Enterprise Security.
- Retention: charges for data kept past the included period, such as Sentinel retention beyond 90 days.
- XDR licensing: per protected device or bundled into suite licenses, by tier. CrowdStrike prices its Falcon bundles per device; Microsoft includes Defender XDR features with licenses such as Microsoft 365 E5; Cisco requires a higher tier for most third-party integrations.
- People: ASD and CISA expect in-house SIEM or SOAR operation to need multiple full-time staff, and note licensing is “only a portion of the total investment.”
They flag one more hidden cost that applies squarely to single-vendor XDR: platforms that need the same vendor’s other products for full functionality, which can create a single point of failure.
Using SIEM and XDR together
XDR feeding the SIEM. The 2024 event logging guidance recommends a central logging facility, such as a secured data lake, that forwards selected logs to SIEM and XDR tools. The ASD and CISA priority logs guidance puts EDR logs first for SIEM ingestion. Microsoft’s Defender XDR connector streams incidents, alerts and advanced hunting events into Sentinel; Defender alerts are free in Sentinel, but some raw Defender data types are billed.
One platform. Vendors’ own descriptions, alphabetical and not ranked:
- CrowdStrike: Falcon Next-Gen SIEM unifies data, detection and response, with an offering for third-party EDR starting with Microsoft Defender.
- Google: Security Operations offers “a unified experience across SIEM, SOAR, and threat intelligence.”
- Microsoft: Sentinel in the Defender portal delivers “a unified SIEM and XDR experience”; Azure portal support ends after March 31, 2027.
- Palo Alto Networks: Cortex XSIAM, with integrated XDR, “replaces traditional SIEM.”
- Splunk: Enterprise Security combines SIEM, SOAR and UEBA.
Several of these vendors’ AI agent layers are covered in the AI SOC platforms comparison and the Zscaler and Red Canary analysis.
SIEM vs XDR vs SOAR comparison table
| SIEM | XDR | SOAR | |
|---|---|---|---|
| Primary job | Collect, correlate and retain logs; alert; investigate; report | Detect and respond across the vendor’s security stack | Automate response workflows |
| Data sources | Any source with a connector or parser | Vendor sensors plus supported integrations | A SIEM or its own collection; acts through integrated tools |
| Retention | Configurable; length is a cost decision | Vendor-set (Defender XDR: 30 days hunting, 180 days portal) | Not a retention tool |
| Detection | Custom rules, correlation, baselines, threat intelligence | Vendor-maintained detections plus custom rules | Relies on SIEM or built-in analytics |
| Response | Alerts; optional automation | Native: isolate devices, disable users | Playbooks: quarantine, block traffic, revoke credentials |
| Pricing unit (vendor-documented) | Mostly data ingested; some workload or activity models | Per device, or bundled with suite licenses, by tier | Licensing plus specialist staff |
| Prerequisite | Prioritized log sources and a baseline | Vendor sensors deployed | An accurately alerting SIEM |
How to decide by team size and compliance needs
- Small team, no SOC, light compliance: XDR from the primary endpoint vendor, with managed detection if nobody can watch alerts around the clock (see MDR vs EDR). Centralize logs cheaply, for example with Logging Made Easy. Skip SOAR.
- Mid-size, regulated or multivendor: XDR for detection and response, plus a SIEM or log repository for retention and cross-source correlation. Feed it XDR incidents and alerts, and filter raw telemetry before ingestion.
- Large SOC or federal agency: a repository-first SIEM with XDR feeding it, then SOAR once SIEM alerting is accurate. Agencies must also meet M-26-14 and CISA’s reference architecture.
- Mostly one vendor’s stack: evaluate that vendor’s converged platform, but price third-party log sources and the exit first.
Whichever mix wins, ASD and CISA recommend regular exercises to confirm alerts fire and playbooks act as intended. The ransomware recovery plan covers the incident response side.
Frequently asked questions
Does XDR replace SIEM?
Usually not where retention or multivendor visibility matters. XDR correlates and responds across the vendor’s products and supported integrations, and native retention is short: Defender XDR advanced hunting covers 30 days unless data is streamed to Sentinel. A small, single-vendor estate with modest retention needs may manage with XDR plus a low-cost log store. Vendors such as Microsoft, Palo Alto Networks and CrowdStrike now sell SIEM and XDR on one platform.
What is the difference between XDR, SIEM and SOAR?
A SIEM collects and analyzes logs from many sources. XDR detects and responds across one vendor’s security tools and its integrations. SOAR automates response through playbooks, typically using a SIEM’s alerts.
Can you use SIEM and XDR together?
Yes. The 2024 event logging guidance assumes it, forwarding selected logs to both. A common pattern streams XDR incidents and alerts into the SIEM, as Microsoft’s Defender XDR connector does for Sentinel.
Is XDR cheaper than SIEM?
The pricing units differ, so there is no general answer: most SIEMs charge by data ingested, while XDR is usually licensed per device or bundled into suite licenses. ASD and CISA add that licensing is only part of SIEM and SOAR cost; staff, training and services make up the rest.
When does SOAR make sense?
After a SIEM alerts accurately. ASD and CISA say SOAR is usually unsuitable for environments without a mature SIEM or an experienced security team, and that a misconfigured SOAR can disrupt service.
Sources
- NIST SP 800-92
- NIST SP 800-92 Rev. 1 draft
- NIST glossary: SIEM
- CISA and ASD’s ACSC: SIEM and SOAR guidance
- ASD’s ACSC, CISA and partners: event logging best practices
- CISA Logging Reference Architecture
- OMB M-26-14
- NCSC: logging for security purposes
- NCSC: Building a SOC
- Microsoft: Defender XDR data retention
- Cisco XDR integrations
Last checked: October 2026. Guidance and product features change; check each source before you rely on it.
Buying? Start from RFPhub’s free SIEM RFP template.