Why SOCs Still Can't Answer 'What Happened?' — The Case for Network Detection

Ask a SOC analyst mid-investigation what actually happened on the wire and you'll usually get a pause.

Not because they're bad at the job. Because the telemetry pile they've been handed — EDR alerts, SIEM correlations, cloud audit logs — rarely reconstructs the event end to end. It flags the symptom. The chain of custody between symptom and root cause is where investigations go to die.

That's the argument resurfacing in network detection and response (NDR) circles, and it's worth taking seriously even if you've heard the pitch before.

The core problem is epistemic. Alerts answer "something matched a rule." They don't answer "what evidence do we have, and how do we know we're seeing all of it in context?" Those are different questions, and the second one is the one that matters when you're writing the incident report or briefing counsel.

EDR is the obvious counterweight, and it's genuinely useful (process trees, command-line capture, file hashes). But EDR depends on an agent being installed, healthy, and not actively under attack by the thing you're trying to detect. The list of devices that can't or won't run an agent keeps growing: appliances, OT gear, contractor laptops, IoT, the firewall itself, anything a vendor sealed shut. Recent edge-device exploitation campaigns against Ivanti, Fortinet, and Palo Alto appliances drove that point home for anyone who wasn't paying attention.

Network telemetry doesn't care whether the endpoint cooperates. Packets traverse the wire regardless. That's the pitch, anyway.

The pragmatic version of NDR isn't full PCAP retention for everything (storage economics still say no). It's selective flow records, protocol metadata, and triggered capture tied to detection logic — Zeek-style logs plus the ability to pull session content when an indicator fires. That gets you the "who talked to whom, when, and what did the handshake look like" record that endpoint data can't reconstruct after the fact.

The operational gap most teams hit is correlation. NDR data sitting in its own console, EDR in another, identity logs in a third, is just three silos with worse handoffs. The value shows up when the network record is queryable next to the endpoint timeline and the auth events, ideally on the same case.

None of this is new. Richard Bejtlich has been making versions of this argument since the network security monitoring book in 2004, and the operational reality keeps proving him right: when endpoint data is missing, manipulated, or simply absent, the wire is what you have left.

For defenders building 2025 budgets, the question isn't NDR versus EDR. It's whether your investigation workflow can answer the basic questions without both. If the honest answer is no, that's the gap to close before the next vendor demo.

(And yes, encrypted traffic complicates the metadata story. It doesn't eliminate it.)