At some point your security will fail. This isn’t pessimism. It’s not because your team and tools aren’t sophisticated enough. It’s the reason we have detections in the first place. And, it’s why once we accept that prevention has its limits, we arrive at an interdiction strategy: finding and disrupting what got in.
After the alert
The alert tells you something happened. However, gaining access to your network doesn’t necessarily mean attackers have stolen data or disrupted the systems they were targeting. They may need to obtain additional access, move to another machine, or further explore the network. Being able to see and understand that activity is the intervention opportunity.
People naturally gravitate toward detections during product evaluations. They’re tangible, easy to compare and quantify, and address the question everyone wants an answer to: Will they catch the attack? There’s often an assumption that the rest will follow, meaning, if the detections are good, surely the investigation will be as well, right?
Whether you can trace the attack, understand the scope, and respond in time to intervene depends largely on the data behind that detection. In network security, a product can have good detections and still leave an analyst struggling to investigate. Perhaps the analyst can see the connection that triggered the alert but can’t follow what happened next. If a search returns nothing, does that mean the activity didn’t happen or that you weren’t collecting the evidence needed to see it?
This, and the arrival of AI defense, is why data quality has recently been getting so much attention.
Data vs. data
Investigation success takes knowledge of both attacker behavior and your own environment. You need to understand what you’re looking for, but also what your data can actually tell you.
The difference in network data shows up when investigating an alert. Both shallow and rich data provide investigations with a starting point, but one can rapidly lead to a dead end. Shallow data is often just composed of timestamps, IPs, and basic connection information. Rich data retains greater transaction details and adds context. It correlates and lets you pivot and reconstruct, answering not just what triggered the alert but what happened before, after, and elsewhere.
To evaluate the data quality of a security tool, consider key questions such as:
- Are full transaction details provided or just a summary?
- Is packet content or file extraction available?
- How far back can we search, and how fast?
- Can I follow a connection across hosts and time?
AI <3 data
AI-powered SOC tools can now process data at a scale that human teams simply cannot match. The more data points AI has, the more effectively it can surface events. While shallow data limits what AI can correlate, richer data allows it to identify subtle patterns across hosts and behaviors, potentially exposing previously unseen indicators of compromise or providing opportunity to intervene before an attack escalates.
AI can help when something unfamiliar is encountered. Nobody knows every service, process, or log format. An assistant can help explain what you’re looking at, suggest questions to pursue, or write a script to make a large set of data easier to examine. That can save a lot of research time. It can also help an analyst get past a point where they would otherwise be stuck.
But we’re certainly not at the point where we can trust what AI claims 100% of the time. You still need to test what it gives you. If an assistant suggests an explanation, check whether the evidence supports it. If it produces a query or script, test what it does. And before running a suggested command, ask what else it might affect. A model can be so focused on solving the immediate problem that it overlooks the rest of the system.
As AI takes on more investigative work, the ability to inspect the underlying evidence becomes another essential aspect of modern data quality.
Unfamiliar territory is the test
When evaluating data from network security products—NDR in particular—take an alert from a demonstration and investigate it properly. But don’t follow the guided path. Dig deep and put yourself in unfamiliar territory. You’ll get a much better sense of how the product helps analysts when they’re dealing with an event they haven’t seen before.
- Look at the transactions behind the alert
- Ask what packet content or extracted files are available
- Follow the activity backwards and forwards in time
- Ask a question that wasn’t anticipated
These questions and tasks probably won’t be part of a typical demo. That’s the point. They’ll let you see if the data provides the fidelity, reach, and context to actually solve investigations or just a starting point with nowhere to go.
Detections get the attention, but data determines the outcome. The real question is can your team use the data to fully understand an incident and decide what to do?
About Corelight:
Your AI SOC is only as effective as the data behind it. Corelight network detection and response (NDR) delivers data that’s open, transparent, and explainable—helping detect evasive threats, reduce triage time, and enable agentic AI throughout the SOC. Corelight’s structured network evidence preserves protocol-level context to produce a more complete dataset for investigation and AI. When analysts and AI can reason from evidence instead of isolated alerts or metadata, they can validate findings, reconstruct activity, and reach more reliable conclusions. Learn more about Corelight at https://corelight.com/cp/elitedefense
Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
