Darktrace Adds Endpoint Process Context to Network Threat Investigations
Summary
Darktrace announced NEXT, combining network visibility with endpoint process telemetry to support automated threat investigations, alongside updates to network detection, response, and security-platform management.
Key points
- Darktrace says NEXT combines network telemetry with endpoint process data through its Darktrace / ENDPOINT agents.
- The company says Cyber AI Analyst uses this context to investigate alerts across network and endpoint activity, prioritize incidents, and add process-level detail.
- Darktrace claims the combined telemetry can help identify novel threats, including zero-days and insider threats; the article provides no independent validation of these claims.
- Darktrace / NETWORK updates include improved protocol detection, custom port mappings, expanded HTTP visibility, and better vSensor performance for tunnel protocols.
- Autonomous Response enhancements add support for complex, segmented networks and more firewall integrations.
- The release also introduces the ActiveAI Security Portal for managing access, permissions, integrations, and multiple environments.
Article Details
- Event Type
- Product release introducing Darktrace Network Endpoint eXtended Telemetry (NEXT) and related platform enhancements.
- Impact
- The release adds native network and endpoint process telemetry for autonomous investigations, and includes updates to network detection, response, portal operations, and exposure management. Darktrace claims these capabilities can improve detection and investigation and contain novel threats, including zero-days, up to 8 days before public disclosure.
Vendors
Products
Autonomous ResponseWe have also released enhancements to Autonomous Response, which is already trusted by thousands of organizations to contain threats at the earliest stages without causing business disruption. This includes enhancedConfidence ScoreConfidence Score: our newly developed AI classification platform will compare newly discovered assets to assets that are known to belong to your organization. The more these newly discovered assets look similar toCost-Benefit Analysis for PatchingCost-Benefit Analysis for Patching: Calculates ROI by comparing patching effort with potential exploit impact, factoring in headcount time, device count, patch difficulty, and automation availability.Cyber AI AnalystThis additional context is then leveraged by Cyber AI Analyst, a sophisticated agentic AI system that autonomously performs end-to-end investigations of all relevant alerts and prioritizes incidents. With the newDarktrace / ENDPOINTDarktrace / ENDPOINT agents are now able to utilize new Network Endpoint eXtended Telemetry (NEXT) capabilities. This combines full network visibility with native endpoint process data, enabling autonomousDarktrace / NETWORKenhancements and innovations to solve modern network security challenges. In the latest release, Darktrace / NETWORK has been enhanced to increase detection efficacy and performance. This includes increased protocolDarktrace ActiveAI Security PlatformAs attackers exploit gaps between tools, the Darktrace ActiveAI Security Platform delivers unified detection, automated investigation, and autonomous response across cloud, endpoint, email, network, and OT. WithDarktrace ActiveAI Security PortalProviding seamless operations with the new Darktrace ActiveAI Security PortalDarktrace Network Endpoint eXtended Telemetry (NEXT)Darktrace Network Endpoint eXtended Telemetry (NEXT) is revolutionizing NDR with the industry’s first mixed-telemetry agent using Self-Learning AI. Deep & Dark Web MonitoringDeep & Dark Web Monitoring: Extends visibility across millions of sources in the deep and dark web to detect leaked credentials linked to your confirmed domains. EDRKillShifterThreat actors are actively targeting and disabling EDR agents, using tools like EDRKillShifter, EDRSilencer, and variants of Terminator, even "legitimate" apps like HRSword are being exploited to undermine endpointEDRSilencerThreat actors are actively targeting and disabling EDR agents, using tools like EDRKillShifter, EDRSilencer, and variants of Terminator, even "legitimate" apps like HRSword are being exploited to undermine endpointExploit Prediction AssessmentExploit Prediction Assessment: Continuously validates whether top-priority exposures are actually exploitable in your environment without waiting for patch cycles or formal pen tests. HRSwordusing tools like EDRKillShifter, EDRSilencer, and variants of Terminator, even "legitimate" apps like HRSword are being exploited to undermine endpoint security.No-Telemetry EndpointNo-Telemetry Endpoint: Collects installed software data and maps it to known CVEs—without network traffic—providing device-level vulnerability context and operational relevance. Terminatortargeting and disabling EDR agents, using tools like EDRKillShifter, EDRSilencer, and variants of Terminator, even "legitimate" apps like HRSword are being exploited to undermine endpoint security.