The five-minute kill chain, reviewed in five consoles
A representative cloud intrusion in 2026 looks like this: a phished session token is replayed from a residential proxy, an identity API call enumerates permissions, a role is assumed, a compute instance is launched with an instance profile, and a data export begins. Elapsed time is often under ten minutes.
In a segmented tooling estate, each of those steps generates an alert in a different product, with different asset naming, and none of the five is individually urgent. The incident becomes visible only in aggregate — which is exactly what no single console can render.
The entity graph is the incident
XDR value comes from resolving all five events to the same entity set and presenting them as one timeline with one owner. The graph joins the identity that acted, the workload that executed, the network path used and the data object touched.
This is also what makes severity meaningful. A suspicious process on a developer laptop and the same process on a jump host with production credentials are not the same event, and only the graph knows the difference.
- One case object per incident, spanning every involved domain
- Timeline ordered on normalized event time with source clock skew corrected
- Automatic scoping: every entity reachable from the confirmed compromise
- Named owner and documented handoff for every state transition
Detection engineering against measured coverage
Coverage is measured per technique and per telemetry source, because a technique observable only through a source you do not ingest is not covered. Publishing the matrix converts detection engineering from an opinion-driven backlog into a gap-driven one.
Detection quality is then managed with three numbers per rule: true-positive rate, contribution to decisions, and time added to triage. Rules that fail all three are retired, not tuned indefinitely.
Containment with guarantees
Response must state what it guarantees. Isolate host, revoke session, disable principal, quarantine workload, block egress destination — each with an expected completion time, a verification step and a documented rollback.
Guarantees are what make automation acceptable. An action with verified completion and a one-step reversal can run unattended; an action without either requires a human, regardless of how confident the detection is.
- Session revocation verified against the identity provider, not assumed from the API response
- Host isolation with forensic capture preserved before network cut
- Every containment action recorded with actor, evidence and reversal path
