"The reality is, though, that organizations can’t just shift left or shift right." — Richard Bejtlich
The case for network interdiction
Richard Bejtlich argues that prevention alone is no longer sufficient. In "NDR Essentials: A Practical Guide to Network Detection and Response," published in partnership with Corelight, he frames defensive success as the ability to interdict — to identify and disrupt malicious activity after an initial compromise but before a full-blown breach. Interdiction, he writes, moves organizations beyond static blocklists toward active threat disruption inside the perimeter, enabling vulnerability mitigation and threat containment so attackers cannot complete their core mission.
Bejtlich highlights four primary sources of network evidence that make interdiction possible: full packet captures, extracted files, transaction logs, and alerts and detections. Modern NDR, he says, does not act as a passive barrier but as a platform for situational awareness and active intervention — preventing propagation of an attack while preserving high-fidelity evidence for investigation.
Threat hunting that begins with a hypothesis
One of the guide’s central prescriptions is behavioral: threat hunting should not be driven by alert follow-up alone. Instead, Bejtlich insists hunts must start with a hypothesis about adversary techniques and then use network queries to validate or disprove that theory. Network evidence remains the "nexus of the investigation."
He lists concrete, network-based techniques for proactive hunting: identify executables, investigate unusual protocols, track large outbound data transfers, detect lateral movement, and analyze certificate exposure. The emphasis is on specific, observable anomalies in network transactions rather than generic security warnings — a shift intended to yield defensible evidence rather than assumptions.
How AI fits into network detection and response
Bejtlich treats artificial intelligence as a force reshaping both offense and defense. In chapter 5 he details three functional areas where AI can materially assist SOC work: optimized alert frameworks (deciding where and how traffic data is captured at the edge or center), agentic triage to accelerate incident response cycles (using autonomous agents to execute playbooks and elevate human decision-making), and tool interoperability (AI orchestration coordinating outputs across network, endpoints, cloud, and applications).
Yet he cautions that human verification remains a "critical control point." Automation must be governed to prevent hallucinations or unintended consequences; when integrated correctly, AI reduces cognitive load, improves evidence-gathering, and up-levels analysts' strategic choices.
Operational prescriptions: zero-baseline and treating alerts as hypotheses
For day-to-day operations, two recommendations stand out. First, Bejtlich advocates a "zero-baseline" strategy for initial alert rules to combat alert fatigue caused by too many pre-enabled detections. Second, he counsels that an alert should be treated as the start of an investigation, not the conclusive definition of an event — a posture that forces deep evidence collection and ensures analysts can finally answer: What happened? What evidence do we have? How do we know we’re seeing it all, in context?
These operational shifts are presented as practical steps for improving the fidelity of investigations at the speed at which attackers now operate, an environment the guide calls the Mythos Era, where vulnerability discovery and automation have expanded both risk and signal volume.
What this means for SOC analysts, security operators, and enterprises implementing NDR
- SOC analysts: Expect AI to assist triage and playbook execution, but retain human verification as a mandated control; focus hunting on hypothesis-driven queries grounded in network evidence.
- Security operations teams and operators: Rework alert baselines toward a zero-baseline posture and treat alerts as investigative starting points, using full packet captures and transaction logs to validate or refute hypotheses.
- Enterprises and procurement leads: Consider NDR platforms that offer comprehensive visibility and AI orchestration; Corelight’s messaging frames its Open NDR Platform as combining deep telemetry with behavioral analytics to accelerate investigations.
Bejtlich’s guide positions network detection and response not as a niche telemetry layer but as a linchpin for interdiction, evidence-driven hunting, and AI-assisted workflows that still require human governance. The free PDF — NDR Essentials — is offered as a practical introduction and playbook for teams that want to strengthen threat hunting and AI-assisted investigations. Organizations seeking to implement these strategies are pointed to additional resources at Corelight’s Elite Defense page.
Read the original: Surviving the Mythos Era: Richard Bejtlich on the Case for NDR — The Hacker News
