Broad and deep observability of security incidents and events from disparate sources for detecting attacks involving non-endpoint or non-protected devices. We assemble security incidents by correlating security signals using our XDR sensors across endpoints, cloud, email, identity, and network.