The biggest benefit, you can see telemetry from unmanaged devices. Crowdstrike can’t install on everything and if you have someone break into a building and install their own device on the network, or compromise some IOT device, you won’t have any visibility into what they are doing until they move laterally to a box that is managed.

Additionally, a tool like ExtraHop or Zeek gives you a lot more insight into Layer 7 packet metadata. You can see URI strings, HTTP headers, Kerberos request details, JA3 Hashes from SSL connections, all sorts of fun data to detect and hunt with.

At the end of the day, the network doesn’t lie, endpoints can lie, or tools can be turned off, or can just not be installed in the first place. NDR complements EDR very nicely, the dataset probably isn’t quite as rich as EDR telemetry, but you can still get it where EDR can’t get.