Cybersecurity
EDR records process, file, and network activity on a computer so an investigator can see what that machine did. SIEM collects logs from many systems so an investigator can see a wider sequence. One does not replace the other. Novatelia scopes endpoint detection and the log platform as separate published solutions, then connects them only when the project needs both.
Revised 2026-10-10. Published by Novatelia. No individual author is named, because no personal credential is claimed for this explanation.
Key points
- EDR is host activity. SIEM is a cross-system log record.
- A SIEM does not see a process tree unless an endpoint sends it.
- Both can be required. Neither is a staffed center.
Definition
Choose EDR when the question is what happened on a device. Choose SIEM when the question is how that device event relates to identity, firewall, or application logs.
How it works
The endpoint agent records local activity and can send a subset to the SIEM. The SIEM does not reconstruct a process tree from a firewall log. The project names which events cross that boundary.
Architecture
- Endpoint: the EDR agent and the computers in scope.
- Collector: the SIEM and the non-endpoint logs.
- Join: the event fields both sides actually share, such as hostname and time.
Use cases
- A malware case needs the process tree, which is an EDR question.
- An account-misuse case needs identity and firewall logs, which is a SIEM question.
- A design must send selected endpoint events into the log platform.
Comparison
- EDR
- Host telemetry: process, file, and connection activity.
- SIEM
- Central logs from many systems, searched together.
Selection guidance
- Write the question the investigation must answer.
- Do not buy a SIEM to avoid deploying endpoint agents.
- Confirm the endpoint product can export the events the SIEM is expected to store.
Questions
Should every SIEM project include EDR?
Only when host activity is in the investigation scope. A log platform can be useful without endpoint agents, and endpoint detection can be useful before a central log platform exists.
Which pages carry the scope?
Endpoint detection and SIEM analytics are separate solutions. Deployment of each is its own service. A product reference such as Log360 does not decide the endpoint product.
Related
More in Cybersecurity
This page defines a term so a project can be scoped. It is not a certification, a test result, or a price. Partnerships are stated only on the partners page. The published address and telephone are the company contact, not a service-level commitment.
Describe the requirement
An RFQ saves a browser draft. It does not publish a price or issue a quotation reference.