The five terms, in plain English
SIEM (Security Information and Event Management)
The software. A SIEM collects the security logs from everything you run (firewalls, servers, laptops, cloud accounts, Microsoft 365, your identity provider, your other security tools) into one place, keeps them, and checks them continuously against detection rules to spot trouble. On its own it is a tool. Someone still has to watch it.
SOC (Security Operations Center)
The people. A SOC is the team of analysts who watch the SIEM, investigate what it finds, and respond. You can build one yourself (expensive, hard to staff around the clock) or use someone else's. "SOC as a service" and "managed SOC" mean the same thing: another company's analysts watch your environment for you.
EDR (Endpoint Detection and Response)
The agent on each machine. EDR is software installed on servers and workstations that watches what happens on that machine and lets an analyst act on it directly, for example blocking a bad address or disabling an account. It sees one machine at a time; the SIEM is what sees everything together.
MDR (Managed Detection and Response)
The service. MDR means people, not just software, watch your security around the clock, investigate alerts and respond on your behalf. In practice it is a managed SOC. The term often gets used for endpoint-only services, so always ask what an MDR actually watches.
XDR (Extended Detection and Response)
The marketing word. XDR means correlating data from many source types (endpoints, network, cloud, email, identity) so an attack that moves between them shows up as one story. A good SIEM with enough integrations already does this. Be careful with the label; ask any vendor what sources their "XDR" actually pulls together.
Side by side
| Term | What it is | Software or people | What it sees |
|---|---|---|---|
| SIEM | Collects and analyzes security logs | Software | Everything you connect to it |
| SOC | Analysts who watch and respond | People | Whatever the SIEM shows them |
| EDR | Agent on each machine | Software | One machine at a time |
| MDR | Analysts watching for you | People (plus their tools) | Depends on the provider; ask |
| XDR | Correlation across source types | A feature of a good SIEM | Endpoints, network, cloud, email, identity |
How Clone Systems covers each one
We sell one service, Managed SOC + SIEM. Here is how the five terms map to it.
SIEM: included, never sold alone
Our SIEM collects logs from more than 100 integrations plus syslog and endpoint agents, checks every detection rule every minute, and maps every incident to MITRE ATT&CK. It is included with the service and is not sold on its own, because a SIEM nobody watches is a very expensive log file. You choose where it runs: our data centers in Philadelphia, Athens or Limassol, or your own environment.
SOC: our analysts, in the United States and the EU, 24/7
Our analysts work the incident queue around the clock, every day. They investigate, attach the evidence, and recommend the response. No action is taken in your environment until it is confirmed.
EDR: agents included for Windows and Linux
Lightweight agents on your servers and workstations send logs, file changes and process activity into the SIEM and give our analysts a way to respond on the machine once an action is approved. If you already run an endpoint tool like CrowdStrike, SentinelOne or Microsoft Defender, we pull its alerts in too, so you keep what you have.
MDR: yes, that is what Managed SOC + SIEM is
If you are shopping for MDR, you are shopping for this: people watching, investigating and responding, across your whole environment rather than just endpoints, with the SIEM and private AI included.
XDR: the correlation is real, the label is not one we use
Our SIEM correlates endpoint, network, cloud, email and identity data in one place and builds an attack path across all of it for every incident. That is what XDR promises. We do not put the XDR label on it, because we would rather describe what it does than add another acronym.
Where the AI fits
Managed SOC + SIEM includes private AI that reads every incident, summarizes it in plain English, maps the attack and drafts the response. Every AI action is previewed and needs a person to approve it. The AI is Clone Systems' own private proprietary AI, so your logs and alerts are never sent to OpenAI, Anthropic or any outside AI service.
How to decide
- You have no one watching security around the clock. You need a managed SOC. Start with Managed SOC + SIEM.
- You already have a SIEM but no one watches it. Managed SOC + SIEM is delivered as one service, with our analysts working in our platform. The tools and log sources you already have connect to it, so nothing you have invested in is wasted.
- You already have an endpoint tool (EDR). Keep it. We integrate with it and add everything it cannot see: network, cloud, identity and email.
- You have been quoted an "MDR" or "XDR". Ask what sources it watches and who is on shift. Then compare it to the list above.
- Your logs cannot leave your environment. Self-host the SIEM with us managing it; the analysts and AI work the same way.
What it costs, in structure
Managed SOC + SIEM is priced per monitored endpoint with a 50 endpoint minimum, on a one-year minimum term with multi-year available. The SIEM, the analysts and the AI are included. It is sold directly through a scoping call and demo, not online.