Beyond the Alert: The Case for Rich Network Data

And, it’s why once we accept that prevention has its limits, we arrive at an interdiction strategy: finding and disrupting what got in; however, gaining access to your network doesn’t necessarily mean attackers have stolen data or disrupted the systems they were targeting.

They may need to obtain more access, move to another machine, or further explore the network.

In network security, a product can have good detections and still leave an analyst struggling to investigate, and a model can be so focused on solving the immediate problem that it overlooks the rest of the system.

Whether you can trace the attack, understand the scope, and respond in time to intervene depends largely on the data behind that detection; perhaps the analyst can see the connection that triggered the alert but can’t follow what happened next.

Both shallow and rich data provide investigations with a starting point, but one can rapidly lead to a dead end; and before running a suggested command, ask what else it might affect.

There’s often an assumption that the rest will follow, meaning, if the detections are good, surely the investigation will be as well, right?

Investigation success takes knowledge of both attacker behavior and your own environment.

The difference in network data shows up when investigating an alert, and if an assistant suggests an explanation, check whether the evidence supports it.