EDR, SIEM, XDR - the tools a SOC runs on. They overlap, but each answers a different question.
SIEM - the log brain
A Security Information and Event Management platform centralizes logs from everything (endpoints, network, cloud, apps), correlates them, and runs detection rules and alerting. Strength: breadth and correlation across sources; the system of record for investigations and compliance. Weakness: only as good as the data you feed it, and it can get noisy/expensive. Examples: Splunk, Elastic, Sentinel, Wazuh.
EDR - the endpoint microscope
Endpoint Detection and Response lives on the host with deep visibility into processes, files, registry and memory - and can respond (isolate a host, kill a process). Strength: rich endpoint telemetry and containment. Weakness: endpoint-only; it doesn't see the network or cloud on its own.
XDR - the unifier
Extended Detection and Response stitches endpoint, network, identity, email and cloud into one correlated detection-and-response layer - essentially EDR's depth plus broader, vendor-integrated context.
How they fit
EDR generates high-fidelity endpoint signals; the SIEM (or XDR) correlates them with everything else to tell the whole story. You don't pick one - you layer them, and you write good detections on top. That last part - the detections - is the skill that makes any of these tools actually work.