Dictionary · Defensive Security

Detection and response that correlates more than one kind of telemetry, such as endpoint, identity, email, and network, instead of looking at endpoints alone.

The extension is the point: a single product view across several control points. The name is used loosely by vendors, so ask which data sources are actually included.

Example: An investigation links a phishing mailbox, a suspicious sign-in, and an endpoint alert as one case instead of three tickets.