CrowdStrike said it agreed to pay $400 million for Humio, which provides cloud log management and observability technology, to boost its extended detection and response (XDR).

London-based Humio, which also has offices in San Francisco, Seattle, and Denmark, counts Aruba, New York City Cyber Command, Bloomberg, Michigan State University, and SpareBank 1 among its customers. The 5-year-old startup developed a data ingestion and analytics platform that CrowdStrike says will enable it to provide contextual index-free XDR “at a speed and scale that no other vendor can match.” Humio claims its platform “has virtually no latency even at massive ingest volumes” and can scale to hundreds of terabytes per day.

XDR combines elements of security information and event management (SIEM), security orchestration, automation, and response (SOAR), endpoint detection and response (EDR), and network traffic analysis (NTA) in a software-as-a-service (SaaS) platform to centralize security data and incident response.

As organizations’ threat surface expands, in part because of COVID-19-induced remote workers, XRD, which shares threat context and enforcement across domains and workloads, becomes an increasingly important security tool. And because of this, many traditional EDR vendors like CrowdStrike (as well as network security vendors like Cisco) are shifting their focus to XDR.

CrowdStrike says its Falcon endpoint and workload protection platform processes 5 trillion security-related events per week using its Threat Graph technology. This patented technology uses threat intelligence and artificial-intelligence (AI) powered analytics to predict and stop threats.

The Humio acquisition will expand CrowdStrike’s XDR capabilities by ingesting and correlating data from any log, application, or feed to deliver actionable insights and real-time protection, CrowdStrike CTO Michael Sentonas wrote in a blog post.

“By leveraging new ingest pipelines and cloud log management, we will continue to help developers, security analysts, and IT professionals gain complete observability to answer any question, explore threats and vulnerabilities, and gain valuable insights from all computer-generated data in real-time,” he wrote.

The companies expect the acquisition to close in CrowdStrike’s first fiscal quarter of 2022.

CrowdStrike’s Humio acquisition follows a slew of XDR announcements in the first two months of 2021. Earlier this month, Trend Micro extended its XDR technology with a new platform called Vision One, and RSA added cloud native analytics and machine learning engines to its NetWitness XDR platform. And in January both McAfee and Fortinet launched XDR platforms.