> ## Documentation Index > Fetch the complete documentation index at: https://docs.onefirewall.com/llms.txt > Use this file to discover all available pages before exploring further. # Federated XDR # Federated XDR ## Overview OneFirewall Alliance is a federated Global XDR platform. Member organizations securely share real-time threat signals through an alliance model, building a threat intelligence ecosystem that spans multiple networks, clouds, and geographies, rather than operating within a single enterprise or data center. ## Key Components ### World Crime Feeds Agent Listener A modular agent that integrates with security telemetry sources, including: * Intrusion detection systems (IDS) such as **Snort** * SIEM platforms such as **ELK Security**, **QRadar**, and **Splunk** * Raw system events, audit logs, endpoint telemetry, and cloud logs Feeds are aggregated, normalized, and enriched using threat intelligence from alliance members. ### Global Threat Intelligence Engine * Curated and enriched using machine learning and human analysis * Sources signals from enterprise environments, public data sources, and proprietary honeypots * Identifies new attack vectors, zero-days, and active campaigns early ### Instruction Layer – Distributed IPS Control Once threats are detected, OneFirewall can instruct defense mechanisms through integrations with: * Firewalls: Checkpoint, Fortinet, Cisco * Endpoint and network security: Trellix, Sophos, SonicWall * Cloud providers: AWS Shield, Google Chronicle SOC * Application security: Cloudflare, web layers, proxies * Routers, email gateways, and more *** ## Comparison with Traditional XDR | Capability | Traditional XDR | OneFirewall Global XDR | | ----------------------- | -------------------------------- | --------------------------------------- | | Scope | Limited to a single organization | Federated across trusted orgs | | Threat Sharing | None or reactive sharing | Real-time alliance-wide sharing | | Detection Model | Post-factum, often local context | Proactive, context-aware | | Integration Breadth | Vendor-specific or limited stack | Multi-vendor, plug-in agnostic | | Threat Response | Delayed, localized playbooks | Global instructions, instant | | Resilience to Zero-Days | Limited without global view | Early detection from collective insight | | Ecosystem | Vendor siloed | Open, trusted alliance | *** ## How It Works ### Proactive Defense Members receive threat data shared by other alliance members before a specific threat targets their organization, rather than relying solely on signature updates. ### Federated Intelligence Threats discovered in one environment inform defenses across all others, reducing mean time to detect (MTTD) and mean time to respond (MTTR). ### Plug-in Ecosystem Integrations support deployment across legacy systems, modern cloud platforms, and hybrid environments. ### Privacy-Preserving Design Information sharing uses metadata exchange, anonymization, and zero-trust principles, within GDPR, HIPAA, and similar compliance boundaries. *** ## Use Cases * Pre-emptively block IPs or domains reported as malicious by other alliance members * Respond to ransomware campaigns observed in other alliance nodes before local infection * Integrate with SIEM/SOAR pipelines to enrich investigations with global context * Orchestrate firewall and endpoint reconfigurations across hybrid environments *** # Compatible Security Products by Category The tables below list SIEM, WAF, EDR, XDR, firewall, and IPS products that are natively compatible with, or have existing integrations with, the OneFirewall Global XDR platform. *** ## SIEM (Security Information and Event Management) | Vendor | Product Name | | ---------- | ------------------------------- | | Splunk | Splunk Enterprise Security (ES) | | IBM | QRadar SIEM | | Elastic | Elastic Security (ELK Stack) | | Sumo Logic | Cloud SIEM | | Microsoft | Microsoft Sentinel | | Exabeam | Exabeam Fusion SIEM | | LogRhythm | LogRhythm SIEM | | Fortinet | FortiSIEM | | Rapid7 | InsightIDR | | Trellix | Trellix Helix | | Graylog | Graylog Security | | Devo | Devo SIEM Platform | | ArcSight | ArcSight ESM | | Securonix | Securonix Next-Gen SIEM | | RSA | NetWitness Platform | *** ## WAF (Web Application Firewall) | Vendor | Product Name | | ---------- | -------------------------------- | | Cloudflare | Cloudflare WAF | | AWS | AWS WAF | | Azure | Azure WAF | | Imperva | Imperva Cloud WAF / SecureSphere | | Akamai | Kona Site Defender | | F5 | BIG-IP Advanced WAF | | Barracuda | Barracuda WAF | | Citrix | Citrix Web App Firewall | | Fortinet | FortiWeb | | Radware | AppWall | | Sophos | Sophos Web Appliance | | Fastly | Fastly Next-Gen WAF | | StackPath | StackPath WAF | *** ## EDR (Endpoint Detection and Response) | Vendor | Product Name | | ----------- | ----------------------------- | | CrowdStrike | Falcon EDR | | SentinelOne | Singularity EDR | | Microsoft | Defender for Endpoint | | Trellix | Endpoint Security | | Palo Alto | Cortex XDR (EDR capabilities) | | Bitdefender | GravityZone EDR | | Sophos | Intercept X | | Trend Micro | Apex One EDR | | ESET | ESET Inspect | | Cisco | Secure Endpoint | | Kaspersky | Kaspersky EDR | | VMware | Carbon Black Cloud | | Cybereason | Cybereason EDR | *** ## XDR (Extended Detection and Response) | Vendor | Product Name | | ----------- | ------------------------------------- | | Palo Alto | Cortex XDR | | CrowdStrike | Falcon XDR | | SentinelOne | Singularity XDR | | Microsoft | Defender XDR (Microsoft 365 Defender) | | Trellix | Trellix XDR Platform | | Trend Micro | Vision One (XDR) | | Sophos | Sophos XDR | | Cisco | Cisco XDR | | Bitdefender | GravityZone XDR | | Fortinet | FortiXDR | | Elastic | Elastic Security XDR | | Rapid7 | InsightXDR | | Cynet | Cynet 360 AutoXDR | *** ## Firewalls | Vendor | Product Name | | ----------- | -------------------------------------- | | Palo Alto | Next-Gen Firewall (NGFW) | | Fortinet | FortiGate | | Cisco | Firepower / ASA | | Check Point | Quantum Security Gateway | | Sophos | Sophos Firewall | | SonicWall | SonicWall NGFW | | Juniper | SRX Series | | WatchGuard | Firebox | | Barracuda | CloudGen Firewall | | Huawei | USG Series | | Hillstone | StoneOS Firewall | | Forcepoint | NGFW | | Untangle | NG Firewall | | Ubiquiti | UniFi Security Gateway / Dream Machine | | Netgate | pfSense | *** ## IPS (Intrusion Prevention Systems) | Vendor | Product Name | | ------------- | ------------------------- | | Cisco | Firepower IPS | | Snort (Cisco) | Snort (open source) | | Suricata | Suricata (open source) | | Palo Alto | Threat Prevention | | Fortinet | FortiIPS | | Trend Micro | TippingPoint IPS | | IBM | X-Force IPS | | Trellix | Network Security Platform | | Check Point | IPS Software Blade | | Juniper | IDP Series | | Hillstone | Network-Based IPS | | NSFOCUS | NSFOCUS NIPS | *** ## Integration Compatibility OneFirewall supports ingestion of telemetry, threat intelligence enrichment, and coordinated response actions across the products listed above, through the plugin ecosystem and the World Crime Feeds Agent Listener. For systems not yet integrated, OneFirewall's team can develop dedicated connectors or adapt existing APIs for compatibility.