When EDR goes dark: why Network Detection & Response (NDR) is more important than ever

Endpoint Detection & Response (EDR) has become a cornerstone of modern cybersecurity. By monitoring activity on endpoints such as servers, workstations and laptops, EDR solutions can quickly identify malware, suspicious processes and malicious behaviour.

However, security professionals increasingly recognise one important limitation: EDR is only effective when endpoint telemetry is available.

If an EDR agent crashes, is not deployed everywhere, or is deliberately disabled by an attacker, visibility can disappear at exactly the moment it is needed most.

This growing challenge is one of the main reasons why Network Detection & Response (NDR) has become an increasingly important layer in modern cyber defence. Rather than replacing EDR, NDR complements endpoint security by providing continuous visibility into network traffic, allowing organisations to detect cyber threats even when endpoint telemetry becomes unavailable.
 

Why EDR alone cannot see every attack

Modern attackers rarely rely on a single technique. Before deploying ransomware, stealing sensitive information or moving laterally through an environment, many threat actors first attempt to reduce visibility.

That may include:

• Disabling or tampering with EDR agents
• Targeting unmanaged or unsupported devices
• Exploiting systems where endpoint protection has not yet been deployed
• Interrupting endpoint telemetry during an attack

While EDR remains an essential security control, organisations need additional detection capabilities that operate independently of the endpoint itself. This is where Network Detection & Response (NDR) provides significant value by continuously monitoring network communications instead of relying solely on endpoint data.
 

The network never stops talking

Even when endpoint visibility is lost, compromised systems continue to communicate. Attackers still need to:

• Resolve domains through DNS
• Contact command-and-control (C2) infrastructure
• Move laterally between systems
• Authenticate against internal services
• Exfiltrate stolen data

Every one of these actions leaves evidence within network traffic. Unlike endpoint telemetry, this communication cannot simply disappear without affecting the attack itself.

That makes Network Detection & Response a powerful complementary detection layer for identifying threats that might otherwise remain hidden. By analysing network behaviour instead of endpoint activity alone, NDR enables organisations to maintain visibility even when attackers attempt to evade endpoint security controls.
 

What is Network Detection & Response (NDR)?

Network Detection & Response (NDR) continuously analyses network traffic to identify malicious activity, suspicious behaviour and indicators of compromise. Rather than focusing on processes running on individual endpoints, NDR observes communication across the network, providing visibility into interactions between users, devices, servers and external infrastructure.

Unlike traditional network monitoring, Network Detection & Response is specifically designed to detect cyber threats by analysing network behaviour, protocol metadata and threat intelligence. As organisations continue to adopt cloud services, hybrid infrastructures and Operational Technology (OT), NDR has become an increasingly important capability for detecting sophisticated attacks across complex environments.

This enables security teams to detect:

• Lateral movement
• Command-and-control communications
• DNS anomalies
• Data exfiltration
• Suspicious protocol usage
• Reconnaissance activity
• Insider threats

By monitoring network behaviour instead of relying solely on endpoint telemetry, Network Detection & Response provides an independent layer of threat detection that complements existing security technologies.
 

How WatchEagle combines multiple detection layers

WatchEagle NDR combines several complementary detection technologies to provide deeper network visibility, improve detection accuracy and reduce false positives.

Instead of relying on a single detection engine, WatchEagle Network Detection & Response correlates information from multiple sources to build a complete picture of malicious activity. By combining signature-based detection, behavioural analysis and threat intelligence, WatchEagle helps security teams detect attacks that individual security tools may miss.

Suricata: detecting known threats in real time
Suricata provides the first layer of network detection. Using deep packet inspection (DPI) and signature-based analysis, it continuously inspects network traffic for known attack techniques and malicious activity. This enables rapid detection of:

• Malware communications
• Exploit attempts
• Known command-and-control traffic
• Protocol abuse
• Intrusion attempts

When malicious traffic matches established detection rules, Suricata can generate immediate alerts, providing the first indication that suspicious activity may be taking place.

Zeek: understanding network behaviour
While Suricata identifies known threats, Zeek focuses on understanding network behaviour. Instead of simply matching signatures, Zeek records detailed metadata about network sessions and protocols, including:

• DNS
• HTTP
• HTTPS/TLS
• SMB
• SSH
• OT protocols over IP

This behavioural visibility helps security analysts reconstruct attack chains and understand exactly how an attacker moved through an environment.

Zeek is particularly valuable for detecting:

• Lateral movement
• Suspicious authentication patterns
• Long-running attacker sessions
• Unusual internal communications
• Insider threats

By analysing behaviour rather than signatures alone, Zeek adds critical context to every detection.

MISP: adding threat intelligence
Detection becomes significantly more valuable when alerts include context. WatchEagle NDR integrates the Malware Information Sharing Platform (MISP) to enrich detections with continuously updated threat intelligence. 

MISP enables organisations to:

• Share indicators of compromise (IOCs)
• Correlate campaigns and threat actors
• Distribute intelligence automatically
• Generate detection rules for Suricata and Zeek
• Feed new observations back into the intelligence ecosystem

This ensures that Network Detection & Response evolves alongside the threat landscape and continues to recognise emerging attack techniques.
 

Correlation creates better detection

Modern cyber attacks rarely consist of a single event. One alert might indicate suspicious traffic, while another reveals unusual authentication behaviour. Separately, these events may seem insignificant. Combined, they often reveal an active attack.

This ability to correlate multiple sources of evidence is one of the defining characteristics of modern Network Detection & Response platforms. Rather than generating isolated alerts, an effective NDR solution connects events across the network to reveal the complete attack chain.

WatchEagle NDR correlates information from multiple detection layers to transform isolated alerts into actionable evidence.

For example:

• MISP identifies communication with a known malicious IP address.
• Suricata detects traffic matching a known attack signature.
• Zeek reconstructs the complete communication session and associated network behaviour.

Rather than presenting disconnected alerts, analysts receive a timeline that explains what happened, how it happened and why it matters.
 

Why layered detection matters

Cybersecurity is no longer about choosing between Endpoint Detection & Response (EDR) and Network Detection & Response (NDR). Modern organisations benefit most when both technologies operate together as complementary detection layers. While EDR focuses on activity occurring directly on endpoints, Network Detection & Response monitors communication across the entire network, providing independent visibility that remains available even when endpoint telemetry is incomplete or deliberately disabled. 

Together, EDR and NDR create a far more resilient detection strategy.

As attackers continue to develop techniques for evading endpoint security, organisations increasingly need independent visibility that can detect malicious activity wherever it occurs. Combining endpoint visibility with network visibility significantly improves the ability to detect, investigate and respond to cyber incidents.
 

Conclusion: endpoint visibility remains essential, but it should not be the only source of truth.

When EDR becomes unavailable, attackers do not stop communicating. Every DNS request, lateral movement, command-and-control connection and data transfer leaves traces within the network. Network Detection & Response (NDR) provides independent visibility into those communications, allowing security teams to detect, investigate and understand sophisticated attacks from the network itself.

By combining signature-based detection, behavioural analysis and continuously updated threat intelligence, WatchEagle NDR delivers correlated evidence rather than isolated alerts. This enables organisations to respond faster, investigate with greater confidence and strengthen their overall cyber resilience.

As cyber threats continue to evolve, combining Endpoint Detection & Response (EDR) with Network Detection & Response (NDR) is rapidly becoming best practice for organisations seeking comprehensive threat detection, greater network visibility and stronger cyber resilience.