Text decision tree

Adapted from Appendix AJ of Decision Trees: Frameworks for Technology Choices. Sources reviewed 2026-11-11.

START: These categories overlap and can be combined; check actual product scope.
Q1. Need endpoint detection and response?
  Yes -> Evaluate EDR. Endpoint detection and response. [Q2]
  No -> Otherwise continue to cross-domain detection. [Q2]
Q2. Need detection across security domains?
  Yes -> Evaluate XDR. Extended detection and response. [Q3]
  No -> Otherwise continue to security log analysis. [Q3]
Q3. Need broad security log analysis?
  Yes -> Evaluate SIEM. Security information and event management. [Q4]
  No -> Otherwise verify existing log coverage. [Q4]
Q4. Need orchestrated response workflows?
  Yes -> Evaluate SOAR. Orchestration, automation and response. [Q5]
  No -> Otherwise keep the documented manual workflow. [Q5]
Q5. Need runtime protection for AI?
  Yes -> Evaluate the claimed AIDR scope. Here: AI detection and response. [END]
  No -> Otherwise focus on the capabilities required by the current environment. [END]
END: Validate telemetry, integrations and response ownership across the whole stack.

AI-generated chapter illustration

Conceptual illustration for Choose SecOps capabilities

The image title omits EDR although the bottom layer includes it. Its stacked architecture and adjacent incident-response flow are conceptual illustrations and do not encode the five yes/no gates or establish dependencies between categories. The AIDR panel uses broader AI/agentic runtime wording; the text defines AIDR as AI detection and response and requires verification of each product scope. Follow the deterministic graph for exact routing.

The illustration was generated in BookWriter. Its visual arrangement is interpretive; use the explicit nodes and routes in the graph and text tree for the decision.

Primary references