Network telemetry in the agentic SOC: what teams need to know

TL;DR: Network detection and response still matters because encrypted traffic, agentless assets, lateral movement, and data exfiltration remain visible at the network layer, while agentic SOC designs also need that telemetry to validate alerts, improve models, and automate response, according to Stellar Cyber.

Editorial analysis by NHI Mgmt Group, based on content published by Stellar Cyber: “NDR is a Requirement for Modern Security Defenses and the Agentic SOC”.

By the numbers:

• The average industrial enterprise still cannot identify 30% of the devices connected to its primary production network, according to McKinsey & Company research cited by Stellar Cyber.
• IDC's 2026 Worldwide Semiannual IoT Spending Guide projects that global spending on IoT/OT will cross the $1.1 trillion mark by the end of 2026.

Key questions

Q: How should security teams use network telemetry in an agentic SOC?

A: Use it as a validation layer, not just a detection feed.

Q: Why do encrypted connections not eliminate network detection value?

A: Encryption hides payloads, but it does not remove flow, timing, destination, volume, and protocol evidence.

Q: What breaks when an environment relies on endpoint tools alone?

A: Coverage breaks wherever assets cannot host agents or where attackers disable them.

Practitioner guidance

• Define NDR as a required telemetry layer for blind-spot environments Make network telemetry mandatory for segments that include OT, IoT, appliances, and other agentless assets, rather than treating EDR as sufficient coverage.
• Baseline normal traffic by segment and protocol Create traffic baselines for internal movement, external destinations, and protocol use so low-and-slow lateral movement stands out against expected behaviour.
• Use network evidence to validate autonomous triage Require AI-assisted SOC workflows to cross-check endpoint alerts against actual traffic before they isolate hosts, alter firewall rules, or escalate incidents.

Bottom line: Network detection and response remains relevant because it sees classes of devices and attack behaviour that endpoint-centric tooling can miss.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →