Need for network visibility in the age of modern EDR

Two security architects from Valtori, the in-house IT provider for the Finnish government, make the case that endpoint detection and response alone leaves gaps. An EDR sees process, file and basic connection metadata from the operating system, but not what travels inside encrypted web traffic. Their goal is to catch threats that get past prevention controls.

They compared what an EDR records with what an SSL-decrypting secure web gateway sees. A PowerShell script correlated process and connection data to show the endpoint view, and gateway logs exposed HTTP methods, headers, downloaded files and passive DNS. In a live phishing-to-C2 scenario, the endpoint raised no alert. The gateway's website categorisation blocked the first implant by chance, but a rebuilt client that used a reused, already-categorised domain got through. They then proposed hunting heuristics: base64 in GET requests to uncategorised sites, highly regular polling, and steady periodic connections, with a clear warning that each produces false positives.

For adversary-in-the-middle phishing, a demo showed a stolen session cookie replayed to get past MFA. Decrypted logs revealed the full login flow, which let responders identify the account that was actually compromised. Their takeaway was to combine application control, EDR and network logs, since no single layer is enough.