A SOC manager argues that network telemetry is redundant because every corporate laptop runs EDR. The network also has printers, IP cameras, contractor devices and IoT sensors. What is the strongest argument for keeping network telemetry?
Select an answer to reveal the explanation.
Short Explanation
EDR only sees the devices you've put an agent on, and attackers love the ones you haven't. Network telemetry watches the roads between all the houses, agent or not. So it fills the blind spots EDR leaves, especially the camera in the corner nobody patched.
Full Explanation
EDR provides deep visibility into processes, files and behavior on managed endpoints, but only where an agent is installed and running. Printers, IP cameras, IoT sensors and unmanaged contractor devices cannot run EDR, and attackers frequently use such devices as footholds or pivot points. Network telemetry, such as flow records, firewall connection events and DNS logs, observes communications between all devices, including those without agents, and reveals lateral movement, scanning, unusual east-west connections and exfiltration patterns regardless of the device type. It also provides independent evidence if an attacker disables or evades an endpoint agent. The storage overhead claim is not the strongest argument; cost comparisons vary by deployment and do not address coverage. Network telemetry does not replace EDR after decryption; it lacks process-level context such as which executable created a connection. EDR agents obtain detection content from their cloud or management service; they do not depend on network telemetry for signatures. Exam caveat: XDR value comes from combining endpoint and network evidence, so the two are complementary rather than competing. Operational check: list the assets that have no EDR agent and confirm each appears in network telemetry sources.