Despite the abundance of telemetry at analysts’ disposal, many security operations teams struggle to answer a few basic questions during incident investigation: What happened? What evidence do we have? How do we know we’re seeing it all, in context?
Answering these questions requires teams to go beyond alerts, the most common basis for initial triage. But investigations (and their outcomes) require defensible evidence, not assumptions, which is what alerts tend to offer.
Alerts are becoming less useful as vulnerability discovery accelerates (a.k.a., the Mythos Era). Most organizations can’t investigate the volume of new findings with existing workflows. Even with increased automation, SecOps teams need validated evidence of active exploit and exposure, not more raw telemetry.
As AI expedites both attacks and defense, security teams need to lay the groundwork that allows them to validate findings, understand attacker behavior, and stop suspicious traffic before it results in a breach.
Richard Bejtlich’s NDR Essentials: A Practical Guide to Network Detection and Response, published in partnership with Corelight, explores how network detection and response (NDR) helps practitioners navigate the current era of networking. The free guide is an introduction to NDR and a practical resource for teams looking to strengthen threat hunting and AI-assisted investigations.
The case for network interdiction
Many security programs focus on prevention. The reality is, though, that organizations can’t just shift left or shift right. Attention and control must be placed throughout the entire attack sequence.
If preventative controls were the simple answer, stolen credentials wouldn’t work once an attacker gains a foothold. Malware would be stopped at the perimeter. And data wouldn’t ever leave its storage environment.
Yet, these events occur all the time.
For these reasons, Bejtlich argues that resilient security programs should focus on interdiction: identifying and disrupting malicious activity before attackers achieve their objectives.
True defensive success depends on an organization’s ability to isolate and contain malicious actors after initial compromise but before a full-blown breach. Interdiction, he argues, shifts the focus from basic blocklists to active threat disruption within the perimeter. It enables vulnerability mitigation and threat containment, helping halt an attack before the adversary achieves a core mission.
The guide explains how NDR supports interdiction by providing visibility into traffic moving throughout the network. Four primary sources of network evidence are worth exploring in depth:
- Full packet captures
- Extracted files
- Transaction logs
- Alerts and detections
Rather than functioning as a passive barrier, modern NDR facilitates active intervention. It gives security teams the situational awareness and context to prevent the propagation of an attack and preserve high-fidelity network evidence.
Threat hunting starts with a hypothesis
One of the strongest chapters in the book focuses on how organizations can evolve threat hunting to match current attacker techniques, ones capable of evading traditional detection boundaries.
According to Bejtlich, threat hunting must not be predicated on alert follow-up. Instead, it should begin with a hypothesis about adversarial techniques. Once a hypothesis is formed, the analyst then runs queries against network logs and sessions to either validate or disprove the theory.
Network evidence remains the nexus of the investigation. Network-based techniques that support proactive threat hunting include:
- Identify executables
- Investigate unusual protocols
- Track large outbound data transfers
- Detect lateral movement
- Analyze certificate exposure
The focus of the hunt should be specific, observable anomalies rather than generic security warnings, which is precisely what can be gained from observing network transactions.
AI in network detection and response
Artificial intelligence has transformed network defense, just as it has transformed attacks against the network. In chapter 5 of the guide, Bejtlich describes how SOC analysts can use AI for the greater good — creating efficiencies, reducing cognitive load, and improving evidence-gathering.
He covers three functional areas in depth:
- Optimized alert frameworks: where and how traffic data is captured — the edge and/or center — and how each affects analysis.
- Agentic triage to accelerate incident response cycles: how autonomous agents should be used to execute playbooks, but just as importantly, up-level human analysts’ strategic decision-making abilities.
- Tool interoperability: though the network is often called the “ground truth,” modern attack investigation requires a holistic view of the network, endpoints, cloud platforms, applications, and so forth. AI orchestration coordinates siloed tools and their outputs.
To achieve maximum efficacy, practitioners can integrate these AI models into daily workflows for their specific use cases (described in detail in the book).
While AI is inevitable in today’s digital ecosystem, human verification remains a critical control point. At least for the near-term, automation must be governed to prevent hallucinations or unintended consequences. When used correctly, AI is a win for investigations and the analysts governing them.
Two lessons for better operations
Successful operations teams continually seek process improvement. Operators must evolve investigative techniques to match today’s speed and sophistication, and the network presents that basis. The book offers numerous operational recommendations, and two stand out for their efficacy:
- Initial alert baselines: Too many pre-enabled rules result in alert fatigue. In turn, alert fatigue numbs and/or buries security teams. Bejtlich therefore, recommends organizations adopt a “zero-baseline” strategy. You can read more about this method in the eBook.
- Alert definitions: Operators should treat an alert as the beginning of an investigation rather than the conclusive definition of an event. Doing so facilitates deep evidence collection in support or rejection of a hypothesis, ensuring that, at the end of the investigation, the analyst can conclusively answer: What happened? What evidence do we have? How do we know we’re seeing it all, in context?
Why network interdiction matters now
Threat actors continue to evolve their tactics, but network evidence remains a definitive source of truth for defense. Practitioners who want to build a modern, resilient security architecture can find actionable strategies within this eBook.
The value of NDR Essentials isn’t simply that it explains NDR. It provides a practical framework for thinking about modern investigations.
To explore these concepts in depth, download the free PDF from the NDR Essentials page. For organizations seeking to implement these modern defensive strategies, additional insights are available at corelight.com/elitedefense.
Corelight Network Detection and Response
Corelight delivers network detection and response (NDR) that accelerates threat investigations through AI-powered defense. Using comprehensive network visibility, behavioral analytics, and evidence-driven detection, Corelight’s Open NDR Platform combines deep network telemetry with actionable context. Analysts can identify threats faster, validate findings with confidence, and take action with clarity.
Learn more at corelight.com/elitedefense.
