1.2Comparing security deployments

SOC visibility is decided by "where you placed the sensors." Watching only the network leaves host-internal behavior invisible; without an agent you cannot follow the contents of encrypted traffic. This section organizes the placement of deployments—network, endpoint, and application—along with agent presence, the difference between legacy AV and next-generation controls, and the roles of SIEM (collect and correlate logs) and SOAR (automate response), as the judgment of "which deployment fills this visibility gap."

1.2.1Placement and agents

• Network-based (NGFW, IPS, NetFlow, proxy, etc.) inspects traffic on the path. It monitors a wide area at once without installing software on hosts, but its weakness is that end-to-end encrypted traffic contents are invisible unless decrypted.
• Endpoint-based (HIDS/EDR, host firewall, anti-malware) installs an agent on the host to observe internal behavior—process creation, file operations, registry changes. It can capture pre-encryption/post-decryption data and OS events, but incurs deployment/maintenance cost across every device.
• Agentless collects state via API integration or from the network side without a resident agent on the device. It is lightweight to deploy and suits BYOD and cloud, but its detail is inferior to agent-based. Conversely, agent-based yields deep telemetry at the cost of device overhead and operations—choose along this visibility/overhead trade-off.

1.2.2Legacy AV and next-generation

• Legacy AV (antivirus) centers on matching signatures (known patterns) of known malware and is weak against unknown/variant or fileless attacks. By contrast, NGAV/EDR combines behavioral detection, machine learning, and endpoint recording and response to catch attacks not in a signature via their behavior.
• Application-based (WAF, RASP, app logs) inspects app-specific attacks like SQLi and XSS at the web app's input/output layer. It is the layer for catching attacks against application logic that are hard to see from network- or endpoint-based controls.

1.2.3SIEM, SOAR, log management, and new environments

• Log management aggregates, stores, and searches logs from devices (retention and search are its purpose). SIEM adds correlation and alerting on top, cross-referencing events from multiple sources to surface threats. SOAR further handles automating response (playbook execution, containment). So the split is collect -> correlate and notice -> act automatically.
• Container/virtualization environments are ephemeral—created and destroyed quickly—so traditional per-host monitoring cannot keep up; container-aware sensors and orchestrator integration are needed. In the cloud, you cannot touch the hardware, so visibility comes mainly from the provider's APIs/audit logs (e.g., cloud audit trails), and you must clarify which layer your organization must watch under the shared-responsibility model.

Your SOC monitors with only a network-based NGFW and NetFlow. One day NetFlow shows a device periodically talking to an unknown external domain over TLS (encrypted), but the contents are encrypted and you cannot tell what is being sent. Jumping to "if the network cannot see through encryption, just decrypt everything at the boundary (SSL inspection)" is not always optimal given privacy, performance, and certificate operations. The sounder judgment is to identify the nature of the visibility gap. What you want now is "which process inside that device is emitting this traffic," which a path-based network control fundamentally struggles to see; deploying an endpoint-based control (EDR agent) captures the process, command line, and write targets before encryption. If the device is BYOD and cannot host a resident agent, you switch to alternatives: accept limited agentless visibility via API, or evaluate the destination reputation from network-side DNS/proxy logs. In the SIEM you correlate NetFlow, DNS, and EDR; once "periodic traffic to an unknown domain + a newly spawned suspicious process + registry auto-run" line up, suspicion of C2 (command and control) grows strong. As confidence rises, a SOAR playbook automatically isolates the device and blocks the domain. The lesson is a chain of deployment judgments: rather than blaming encryption and brute-forcing decryption, choose the deployment (network / endpoint / agent presence) to match the kind of visibility you need, unify it in SIEM, and act with SOAR.

1.2.4Section summary

• Choose deployment by the visibility gap: network-based is broad but blind to encrypted contents, while endpoint-based (agent) sees internal behavior at deployment cost
• Legacy AV matches signatures, NGAV/EDR detects behavior; app-specific attacks are caught by app-based controls (WAF, etc.)
• The staged split log management (aggregate) -> SIEM (correlate/alert) -> SOAR (automate response); containers are ephemeral and cloud visibility comes from APIs/audit logs