What is XDR?

Traditional security tools usually work in silos: antivirus on endpoints, firewalls on the network, logs in separate systems. An XDR platform brings this data together in one place, correlates events from different sources and helps security teams detect attacks that would go unnoticed when each tool is looked at in isolation. It also automates the response, reducing the time between detection and containment.

Since November 2024, I’ve been the Tech Leader of Blockbit XDR, Blockbit’s Extended Detection and Response platform. I built the product’s MVP and now lead the squad that develops and operates it.

detection and containment.

The product

Blockbit XDR combines endpoint and network data to identify threats, correlate events and automate incident response. It’s offered as SaaS, hosted in Blockbit’s cloud, with native integration with the company’s threat intelligence.

What I do

• Built the MVP and defined the platform architecture
• Technical leadership of the squad: prioritization, code reviews and architecture decisions
• Administration of the full stack: server clusters, event indexing and search, agent management
• Active Directory integration with automated response, such as disabling accounts on suspicious detections
• Maintenance of the agent installer for large-scale deployment at customers
• Integrations with customer environments, such as forwarding alerts via syslog
• Cost optimization of the cloud infrastructure

Challenges

Running a security platform as a service means handling large volumes of events from many customers while keeping detection fast and the infrastructure cost under control. On the leadership side, the challenge is balancing new features, customer demands and the stability of a product that customers rely on to protect their environments.

What I learned

Moving from individual contributor to Tech Leader taught me that technical decisions are also people and business decisions. Building an MVP from scratch and growing it into a production platform showed me how important it is to make pragmatic choices early and to keep the architecture flexible enough to evolve.

Learn more

• Product page: https://www.blockbit.com/en/blockbit-xdr-en/
• Launch announcement (in Portuguese): https://www.prnewswire.com/br/comunicados-para-a-imprensa/blockbit-lanca-xdr-para-fortalecer-a-defesa-digital-das-empresas-com-recursos-de-inteligencia-artificial-e-machine-learning-302294529.html