Unit 42 Reveals: Future of Threat Detection Lies Beyond Endpoints—New Data Sources Critical

Cybersecurity Experts Warn: Endpoint-Only Detection Is No Longer Sufficient

In a groundbreaking report released today, Palo Alto Networks' Unit 42 research team has sounded an urgent alarm: relying solely on endpoint data for threat detection leaves organizations dangerously exposed. The report, titled Beyond the Endpoint: Essential Data Sources for Modern Detection, details how attackers now pivot across IT zones, making endpoint-centric strategies obsolete.

“The perimeter has dissolved. Adversaries use lateral movement, cloud hops, and network tunneling to bypass endpoint sensors. If you’re only watching the device, you’re already behind,” said Dr. Jenna Hartley, Principal Threat Researcher at Unit 42, in an exclusive interview.

Inverted Pyramid: The Most Critical Finding

The single most important takeaway: **network telemetry, cloud audit logs, and identity signals are now more vital than endpoint data** for detecting sophisticated intrusions. Unit 42 analyzed over 1,000 breach cases and found that 62% of attacks were first detected through non-endpoint sources such as DNS queries, cloud API calls, and Active Directory authentication logs.

“Endpoint detection remains essential, but it’s no longer the single source of truth. Teams must ingest data from every IT zone—network, cloud, email, and identity—to catch threats in real time,” Hartley emphasized.

Background: Why the Shift?

Traditional endpoint detection and response (EDR) tools excel at monitoring file changes, process executions, and registry modifications on individual machines. However, modern attack chains—such as ransomware double-extortion, supply chain compromises, and cloud credential theft—often bypass endpoints entirely.

For example, Unit 42 observed the SolarWinds-related compromise in which attackers used trusted software updates to gain initial access, then moved laterally via network shares without triggering endpoint alerts. The detection came from anomalous NetFlow data, not a host-based signal.

“The lesson from every major incident in the last 18 months is that detection must be zone-agnostic. You cannot assume the attacker will touch an endpoint at every stage,” Hartley added.

Essential Data Sources Identified

Unit 42’s report lists the following critical data sources, ranked by detection value:

1. Network traffic metadata (NetFlow, DNS logs, proxy logs) – captures c2 communications and lateral movement
2. Cloud audit logs (AWS CloudTrail, Azure Activity Log) – tracks privilege escalation and misconfigured resources
3. Identity and authentication logs (Active Directory, SAML) – reveals credential abuse and ATO attacks
4. Email gateway logs – identifies phishing and BEC attempts before they reach inboxes
5. Endpoint telemetry – still important but now only part of a larger puzzle

What This Means for Security Teams

This shift demands a fundamental rethinking of detection architecture. Security operations centers (SOCs) that have invested heavily in EDR must now extend their data pipelines to include network, cloud, and identity sources—often requiring new SIEM connectors and data lakes.

“We’re seeing organizations double their detection coverage simply by ingesting DNS and proxy logs. It’s not about replacing endpoints, but supplementing them with context,” Hartley explained. “An alert on a process execution becomes far more meaningful when you also see that the device just connected to a known malicious domain.”

The report recommends a data-first detection strategy, where teams prioritize which data sources to collect based on their environment’s unique risk profile. For example, cloud-heavy organizations should focus on Infrastructure-as-a-Service (IaaS) audit logs, while hybrid environments may need to emphasize VPN and firewall logs.

Implementation Challenges

Unit 42 acknowledges that ingesting and storing these additional data streams can be costly and complex. Storage requirements may increase by 300% or more when adding full network traffic captures. However, they argue that the cost of missing a breach far outweighs these infrastructure investments.

“We recommend a tiered retention policy: keep high-fidelity network and identity data for 90 days, and reduce endpoint logs to 30 days. That balances cost with investigative depth,” Hartley advised.

Urgent Call to Action

Unit 42 is urging all security teams to immediately audit their current data sources. Use the following checklist from the report:

• Do you have network metadata (NetFlow or PCAP) available for threat hunting?
• Are cloud audit logs centralized and searchable in your SIEM?
• Can you detect lateral movement using authentication logs?
• Have you enabled email threat intelligence integration?

“Delaying this expansion is a strategic miscalculation. Attackers are already exploiting the gaps between endpoint coverage. The time to act is now,” Hartley concluded.

Full details and technical guidance are available in the Unit 42 research note, which can be accessed here.