Beyond the Alert: The Case for Rich Network Data

Securing a network is an ongoing battle that will inevitably encounter failures. However, the goal is not to avoid detection, but to identify and disrupt threats once they have infiltrated the system. An alert is an indication that something has occurred, but it doesn't always mean data has been stolen or the targeted systems have been disrupted.

Attackers may require additional access, move to another machine, or conduct further exploration within the network. Therefore, having the ability to observe and comprehend this activity represents an opportunity for intervention. The focus on detections, during product evaluations, is understandable due to their visibility, comparability, and the question of whether they will detect an attack.

However, the quality of investigation depends largely on the data behind these detections. Even if a product has excellent detections, it may still leave an analyst struggling to understand the scope of the attack and respond promptly to intervene. Much attention has been given to the quality of data in network security, particularly with the arrival of AI defense.

Rich data, which contains more transaction details and context, can provide a deeper investigation starting point. While shallow data, consisting mainly of timestamps and basic connection information, can serve as a starting point for investigations, it can quickly lead to a dead-end. AI-powered tools can process data at a scale that human teams cannot match.

The more data points AI has, the better it can identify subtle patterns across hosts and behaviors, potentially discovering indicators of compromise that were previously unseen, and allowing for intervention before an attack escalates. AI can be particularly helpful when encountering unfamiliar services, processes, or log formats.

An assistant can explain what is being observed, suggest questions to pursue, or write scripts to facilitate the analysis of large datasets. However, AI is not yet at the stage where we can completely trust its claims. We must still verify the evidence it provides. If an assistant offers an explanation, it's essential to check whether the evidence supports it.

If it generates a query or script, we should test its functionality and consider any potential system-wide effects. As AI assumes a larger role in investigations, the ability to inspect underlying evidence becomes a critical aspect of data quality. When evaluating network security products, particularly NDR, one should investigate alerts thoroughly rather than following a guided path.

By digging deeper and exploring unfamiliar territory, one can gain a better understanding of how the product assists analysts in dealing with unknown events. These questions and tasks may not typically be part of a demonstration, but they are crucial in determining whether the data provides the necessary fidelity, reach, and context to solve investigations or merely serve as a starting point.

The effectiveness of an AI SOC is only as good as the data behind it. Corelight network detection and response (NDR) offers open, transparent, and explainable data, enabling the detection of evasive threats, reducing triage time, and enabling agentic AI throughout the SOC. Corelight's structured network evidence preserves protocol-level context, providing a more comprehensive dataset for investigation and AI.

Analysts and AI can reason from evidence instead of isolated alerts or metadata, leading to more reliable conclusions. To learn more about Corelight, visit https://corelight.com/cp/elitedefense.