Threat detection, investigation, and response (TDIR) explained: the unified SOC workflow that connects detection, investigation, and response

Threat detection, investigation, and response (TDIR) is a SOC operating model that unifies detection, investigation, and response into one intelligence-driven workflow. It is delivered either as a process across existing tools — SIEM, SOAR, EDR, NDR, ITDR, XDR — or as a converged platform that consumes and correlates those signals. TDIR is the discipline; the platforms are one delivery path. The urgency is hard to ignore. Mandiant's M-Trends 2025 reports median global dwell time rose to 11 days in 2025, while the SANS 2025 SOC survey, surfaced via Torq, found 76% of SOC teams cite alert fatigue as their top operational challenge. This guide walks through what TDIR is, how it differs from adjacent acronyms (TDR, ITDR, MDR, XDR, EDR, NDR), how its four phases map to NIST CSF 2.0 and MITRE D3FEND v1.3.0, the DORA, NIS2, and SEC clocks now baked into the response phase, and what "good" looks like in 2026.

What is TDIR?

Threat detection, investigation, and response (TDIR) is a SOC operating model that unifies three phases — detection, investigation, and response — into a single intelligence-driven workflow, often packaged as a converged platform that ingests signals from SIEM, SOAR, EDR, NDR, ITDR, and XDR. TDIR is the discipline; converged TDIR platforms are one delivery model among several.

The framing matters because the term is vendor-conflated. Some vendors describe TDIR as a product category; others describe it as a workflow that runs across existing tools. Both views are valid. Buyers should treat TDIR as a workflow and select tools that support it. Vendors with platform offerings will reasonably package the same workflow as a category. The practical implication: do not buy a "TDIR platform" without first understanding what TDIR is supposed to do for your SOC — otherwise you risk replacing existing capabilities you already paid for.

TDIR sits inside the broader incident response lifecycle and is one of the workflows a modern SOC operations team runs every day. What distinguishes TDIR from traditional incident response is that it elevates investigation as a distinct phase between detection and response. In legacy IR programs, investigation was often compressed into triage — a brief sanity check before escalation — which left analysts treating low-fidelity alerts as if they were incidents. TDIR reframes investigation as the phase where alerts become incidents, where attack timelines get reconstructed, and where the response playbook is selected based on evidence rather than alert label.

TDIR also explicitly bakes in regulatory notification within fixed clocks. The response phase now includes communication obligations under DORA, NIS2, the SEC Cyber Disclosure Rule, and similar regimes. This is a meaningful departure from earlier TDR (threat detection and response) framing, which treated regulatory disclosure as an afterthought. We cover the clock mechanics in the compliance section below.

The four phases — detection, investigation, response, and post-incident learning — run as a continuous loop, not a one-shot pipeline. Each loop iteration feeds detection-engineering improvements back into the alerting pipeline so the SOC gets quieter and more accurate over time. Industry definitions converge on this loop framing: see the NetWitness TDIR glossary and ReliaQuest's TDIR guide for two industry treatments.

TDIR vs adjacent terms: the disambiguation matrix

Search engines treat TDIR, TDR, ITDR, MDR, XDR, EDR, and NDR as seven distinct queries with overlapping but separate intent. Collapsing them into one comparison is both an SEO mistake and a buyer-clarity mistake. The matrix below resolves the most common conflations.

Caption: TDIR vs adjacent acronyms — definitions, primary signal source, search intent, and overlap with TDIR.

The narrative resolution is short. TDR is the broadest discipline. TDIR is a workflow within TDR that elevates investigation as a distinct phase and bakes in regulatory clocks. ITDR, EDR, and NDR are signal-specific subsets — each one feeds the TDIR workflow with a particular kind of telemetry. XDR is a tool category that pre-correlates several of those signal sources. MDR is a service-delivery model that operationalizes the entire TDIR workflow on behalf of a customer.

A practical buyer test: if a vendor positions their offering as "TDIR" but only consumes endpoint telemetry, it is EDR with marketing. If it covers endpoint, identity, and network with one investigation pane and time-bound response automation, it is closer to genuine TDIR. The difference is not the label — it is the breadth of signal sources, the depth of investigation context, and whether response includes the regulatory communication obligations.

Why TDIR matters now

Three concurrent forces are forcing TDIR onto the 2026 board agenda.

• Median dwell time rose to 11 days in 2025, up from 10 days in 2023, with 45.1% of intrusions found within one week — a bifurcation between fast-detect and slow-detect organizations (Mandiant M-Trends 2025).
• AI and automation savings are now quantified. Organizations using AI and automation extensively save approximately $1.9 million per breach and shorten the breach lifecycle by 80 days (Ponemon Institute Cost of a Data Breach Study, 2025).
• SOC operating pressure is at record levels. 76% of SOC teams cite alert fatigue as their top operational challenge, with 63% to 76% reporting burnout (SANS 2025 surfaced via Torq). The average enterprise SOC now costs $5.3 million annually, up 20% year over year (Ponemon, surfaced via databahn).
• Manual processes still dominate. 85% of organizations rely on predominantly manual security processes (CISA, surfaced via JumpCloud).
• Hybrid blind spots remain endemic. 67% of organizations cite network blind spots as a top challenge (Fidelis hybrid network visibility, 2026).
• Agentic AI is forcing a 2-to-3-year architecture decision. Gartner forecasts 50% of TDIR platforms will incorporate agentic AI security by 2028, up from less than 10% in 2024 (Gartner via BleepingComputer, 2026).

Industry research and analyst forecasts now converge on roughly 40% efficiency gains across the TDIR workflow when AI and automation are applied at scale — a composite outcome of less time triaging, less time investigating, and less time tuning rules. That figure is best treated as a triangulated estimate from the four primary stats above, not a single-source claim. The directional message is what matters: SOCs that modernize TDIR meaningfully outperform those that do not, and the gap is widening.

CSO Online's 2026 CISO priorities list places TDIR modernization in the top tier alongside identity security and AI governance — reflecting the same forces. For SOCs operating with under 5 FTEs, the choice is no longer "modernize or stand still." It is "modernize or fall behind on dwell time, regulatory exposure, and analyst retention simultaneously."

How TDIR works: the four phases

The TDIR workflow runs in four phases — detection, investigation, response, and post-incident learning — and it loops, with each iteration feeding lessons back into detection engineering. The four-phase view aligns with industry-standard lifecycle treatments and with the phases defined in NIST SP 800-61 Rev 3.

Phase 1 — Detection. The SOC aggregates telemetry from EDR (endpoint), NDR (network east-west and north-south), ITDR (identity), SIEM (logs), and cloud control planes; applies rule-based, behavioral, and ML detections; and surfaces high-fidelity alerts. Detection engineering shifts focus from rule-writing to behavior modeling. This phase maps to NIST CSF 2.0 DETECT (DE.AE Anomalies and Events, DE.CM Continuous Monitoring, DE.AN Detection Processes) and to MITRE ATT&CK tactics in scope, including TA0001 Initial Access, TA0008 Lateral Movement, and TA0010 Exfiltration. Modern detection increasingly uses AI threat detection and behavioral analytics to surface unknown threats that rule-based systems miss.

Phase 2 — Investigation. Analysts triage alerts, enrich them with threat intelligence, asset criticality, and identity context, correlate alerts into incidents, build attack timelines, and validate true positive versus false positive. Investigation has its own internal sub-loop: validation, contextualization, and post-incident analysis. The output of investigation is not "this alert is real" — it is a fully reconstructed incident with scope, blast radius, and a confidence-weighted recommendation. This is where alert volume becomes incident clarity. Investigation also produces the hypotheses that feed threat hunting workflows when analysts have spare capacity.

Phase 3 — Response (containment, eradication, and recovery). The SOC contains the threat (isolate endpoint, revoke session, disable account, block IP), eradicates persistence (remove implants, rotate credentials, patch the entry vector), and recovers (restore from clean backup, validate integrity). Response also includes regulatory notification within fixed clocks, which is now a non-negotiable part of the playbook. This phase maps to NIST CSF 2.0 RESPOND (RS.MA, RS.AN, RS.MI, RS.CO, RS.IM) and RECOVER (RC.RP).

Phase 4 — Post-incident learning. Lessons learned, playbook refinement, detection-engineering backlog updates, and board reporting close the loop. The findings feed back into detection content and into the investigation playbook. This phase maps to NIST CSF 2.0's IMPROVE category and to the GOVERN function (GV.OC, GV.RM, GV.RR), which is new in CSF 2.0 and explicitly elevates governance to a top-level function.

The "four methods of threat detection" question (a recurring PAA query) maps cleanly across Phase 1: signature-based (known IOCs), anomaly-based (statistical and behavioral baselines), heuristic and rule-based (correlation logic), and ML-driven (supervised and unsupervised models including behavioral analytics and AI threat detection). Mature TDIR programs run all four in parallel — none alone is sufficient.

Watch how threat signals can move from detection to investigationand response, helping SOC teams understand attack context andact on the threats that matter most.

TDIR phases mapped to NIST CSF 2.0 and NIST SP 800-61r3

Caption: TDIR phases mapped to NIST CSF 2.0 functions and NIST SP 800-61 Rev 3 phases.

TDIR phases mapped to MITRE ATT&CK and D3FEND

MITRE ATT&CK describes adversary behavior; MITRE D3FEND v1.3.0, released December 2025, describes defensive countermeasures across 267 techniques in 7 tactics: Model (27), Harden (51), Detect (90), Isolate (57), Deceive (11), Evict (19), and Restore (12). The TDIR detection phase maps to ATT&CK tactics on the offensive side. The TDIR response phase maps directly to D3FEND's Isolate, Evict, and Restore tactics. The full crosswalk, including representative D3FEND techniques per response sub-phase, lives in the compliance section below.

TDIR and the SOC stack: signal sources, execution layer, service models

TDIR is not a new pillar in the SOC stack. It is the workflow that connects the existing pillars. Reading the architecture cleanly prevents tool sprawl and clarifies build/buy decisions.

• Signal sources (what TDIR consumes). NDR for east-west visibility and lateral movement detection, EDR for endpoint behavioral detection, ITDR for identity-based attack detection (credential misuse, privilege escalation), SIEM for log correlation and audit, and XDR as a converged correlation tier when present. Together these form what some practitioners call the SOC triad — visibility across endpoint, network, and logs, with identity as a fourth dimension that has earned its own discipline.
• Execution layer (what TDIR runs through). Incident response automation and SOAR for playbook orchestration, plus agentic AI for autonomous Tier-1 and Tier-2 actions. The execution layer is where containment turns from "an analyst clicks isolate" into "a playbook isolates within seconds and notifies the right human." This is also where the regulatory clock starts running once an incident is confirmed.
• Service-delivery models. Self-managed (internal SOC running its own tooling), MDR-delivered (an outsourced 24/7 SOC operates the workflow on the customer's behalf), or hybrid (co-managed with a partner handling out-of-hours triage). MDR is not a competitor to TDIR — it is a delivery model for TDIR.

The buyer takeaway: ask which layer each tool serves. If the answer is unclear, the tool is probably overlapping with something you already own. The RSAC 2026 floor featured roughly 36 AI-SOC vendors with largely undifferentiated messaging — analysts now separate "rebranded automation" from genuinely autonomous architectures based on durable retention, mesh-agent architecture, and breadth of signal sources across SIEM, NDR, ITDR, and UEBA.

TDIR in practice: dwell time, regulatory clocks, and breach lessons

Three industry use cases and three breach examples make the abstract concrete.

Use case 1 — Financial services and DORA. A European bank deploys TDIR to satisfy DORA's 4-hour incident classification clock, 24-hour advance notification, and 72-hour detailed report. The TDIR platform correlates identity, network, and cloud signals to detect credential theft and business email compromise patterns within minutes — fast enough to make the 4-hour clock survivable. See ISACA's NIS2 and DORA whitepaper for the regulatory framing. Financial services is the highest-stakes TDIR adoption sector because the clocks are the tightest. For more, see financial services cybersecurity.

Use case 2 — Healthcare and MDR-delivered TDIR. A mid-market hospital with under 5 SOC FTEs adopts MDR-delivered TDIR to handle 24/7 detection and response across a hybrid estate that includes IoMT devices, EHR systems, and clinical workstations. The lesson: resource-constrained SOCs are the highest-ROI TDIR adopters because the marginal cost of MDR delivery is much lower than the marginal cost of hiring two more analysts. See healthcare cybersecurity for sector-specific context.

Use case 3 — Manufacturing and OT/IT TDIR with D3FEND-OT. A discrete manufacturer extends TDIR coverage to operational technology environments using the D3FEND-OT mappings released December 16, 2025. The TDIR platform consumes both IT and OT signal sources, with response playbooks aware of safety-system constraints — a lesson learned the hard way by manufacturers that treated OT incident response as a generalization of IT IR.

Breach lesson 1 — Salt Typhoon. The China-attributed campaign against telecoms and edge devices for CALEA-style intercept access remains active per the FBI's February 2026 update. The TDIR phase failure was network detection: limited east-west visibility on edge devices and patch-hygiene gaps. Salt Typhoon is the canonical "why network detection still matters" reference for buyers who think EDR-only TDIR is sufficient.

Breach lesson 2 — Scattered Spider's April 2026 wave. Identity-driven lateral movement via help-desk social engineering. The phase failure was ITDR — credential misuse went undetected because the SOC's signal sources stopped at endpoint and network and never modeled identity behavior. Scattered Spider has consistently demonstrated that EDR-only TDIR programs miss the identity-based lateral movement phase.

Breach lesson 3 — Vimeo via Anodot third party. A supply-chain analytics integration served as the ingress point. The phase failure was vendor-log monitoring: third-party telemetry was ingested but never correlated against business-context signals. This echoes the Verizon DBIR 2025 finding that third-party-involved breaches doubled to 30% year over year, often arriving via living off the land techniques and credentialed access patterns that look benign to log-based detection.

The quantified outcomes anchor the section. Mandiant 2025 reports an 11-day median dwell when intrusions are internally detected, 26 days when externally notified, and 5 days when an adversary (typically a ransomware operator) notifies the victim — a stark indicator that proactive detection compresses the timeline by more than 60%. AI and automation, applied at scale, save roughly $1.9 million per breach and 80 days of breach lifecycle. Detection of exfiltration and ransomware precursors during the lateral-movement phase is where most of those savings come from. April 2026 ransomware activity is documented in detail by BlackFog, CYFIRMA, and CM-Alliance, reinforcing that TDIR maturity directly translates into ransomware containment speed.

Detecting and preventing TDIR failure modes

Most TDIR programs do not fail because of bad tools. They fail because they measure the wrong things or skip the disciplines that turn alerts into incidents.

Best practices synthesized from industry guidance:

• Detection engineering as a function, not an afterthought. Shift from rule-writing to behavior modeling, version-control detection content, and tie every detection to an ATT&CK technique.
• Threat intelligence integration on every alert. IOC reputation, asset criticality, and business context should be enriched at ingest, not at investigation time.
• Playbook discipline. Version control, regular tests, and MITRE-mapped coverage. A playbook that has not been exercised in 90 days is a hypothesis, not a control.
• Pillar-based SecOps. Detection engineering, alert fidelity, investigation and hunting, and IR — each pillar staffed and measured separately.

KPI framework — what to measure:

Caption: TDIR KPI framework — primary, secondary, and business metrics aligned to NCSC April 2026 SOC-metrics guidance.

What NOT to measure. The UK NCSC's April 28, 2026 guidance on SOC metrics, reported by Help Net Security, warns that ticket-closure speed, rule count, and log volume incentivize false-positive dismissal and noisy detection content. NCSC recommends hypothesis-led threat hunting, TTD/TTR, and MITRE-mapped playbook coverage as the durable KPIs. This is the most useful "what not to measure" anchor available — vendor-neutral and government-issued, suitable for board-level reporting. For deeper context on KPI design, see cybersecurity metrics.

Common failure modes. Tool sprawl without correlation produces alert fatigue and is the dominant pain point cited by 76% of SOCs. EDR-only TDIR misses identity-based attacks — Quest KACE-class identity-trigger CVEs from 2025 demonstrate the class of attack EDR cannot see. Network blind spots affect 67% of organizations. Stale playbooks without MITRE mapping are detection theater. Vendor-claimed efficiency numbers (40%, 80%, 95%) require third-party corroboration before they belong in a business case — pin TDIR efficiency claims to Ponemon, Mandiant, SANS, and Gartner before promising the board. The realistic SOC analyst experience is shaped more by detection content quality and KPI choice than by any single product feature.

TDIR and compliance: NIST CSF 2.0, SP 800-61r3, MITRE D3FEND, and the regulatory clocks

This is where TDIR earns its keep with auditors and with the board. Three frameworks plus three regulatory regimes converge on the response phase.

NIST CSF 2.0 crosswalk. The NIST Cybersecurity Framework v2.0 release added GOVERN as a new top-level function and refined DETECT, RESPOND, and RECOVER. TDIR phases map to:

• DETECT: DE.AE Anomalies and Events, DE.CM Continuous Monitoring, DE.AN Detection Processes
• RESPOND: RS.MA Management, RS.AN Analysis, RS.MI Mitigation, RS.CO Communication, RS.IM Improvement
• GOVERN (new in 2.0): GV.OC Organizational Context, GV.RM Risk Management, GV.RR Roles and Responsibilities
• RECOVER: RC.RP Recovery Planning

The full framework text is in the NIST CSF 2.0 PDF.

NIST SP 800-61 Rev 3 (April 2025). The latest revision of the computer security incident handling guide explicitly endorses automation of alerts, triage, and information sharing. The phases — Detection and Analysis, Containment, Eradication, Recovery, and Post-Incident Activity — align cleanly with the TDIR four-phase loop.

MITRE ATT&CK and D3FEND. MITRE ATT&CK describes adversary behavior. MITRE D3FEND v1.3.0 describes defensive countermeasures. The response phase maps to D3FEND's Isolate, Evict, and Restore tactics with the following representative techniques:

Caption: TDIR response sub-phases mapped to MITRE D3FEND v1.3.0 (Detect 90, Isolate 57, Evict 19, Restore 12).

D3FEND v1.3.0 spans 267 defensive techniques across 7 tactics, and the December 2025 D3FEND-OT extension brings operational technology mappings into scope.

Regulatory reporting clocks. The response phase now has hard deadlines, and they differ by jurisdiction.

• SEC Form 8-K Item 1.05 (SEC Cyber Disclosure Rule): material cyber incidents disclosed within 4 business days post-materiality determination. Effective September 5, 2023; smaller reporting companies began complying June 15, 2024; Inline XBRL tagging required from December 18, 2024. The SEC final rule fact sheet covers the materiality threshold mechanics.
• DORA (EU) — effective January 17, 2025: major incident classification within 4 hours of detection, advance notification within 24 hours, detailed report within 72 hours. See DORA regulatory guidance for the operational expectations.
• NIS2 (EU): 24-hour initial notification, 72-hour detailed report, 1-month final report. Sector and member-state variations apply.

The practical implication is significant: the 4-hour DORA classification clock is tighter than the 72-hour detail window, and it is what drives playbook design. Build the regulatory clock into the response-phase playbook — including a named decision-maker for materiality determination and a pre-approved disclosure template — rather than treating it as a post-incident exercise. CIS Controls v8 Control 17 (Incident Response Management), particularly 17.1, 17.2, 17.4, and 17.8, provides the operational scaffolding. For broader context, see compliance, security frameworks, and GDPR compliance.

The CISA Known Exploited Vulnerabilities catalog provides another regulatory anchor for TDIR programs serving federal agencies and contractors — KEV inclusion triggers patching and detection-content obligations that flow directly into the TDIR detection phase.

Modern approaches: agentic AI, platform vs workflow, and build vs buy

Three modes of TDIR automation now coexist. SOAR is rule-based playbooks across heterogeneous tools — durable but brittle when alert types drift. ML-assisted is scoring, correlation, and prioritization on top of human triage — proven and broadly deployed. Agentic is autonomous agents that plan and execute multi-step response — the 2026–2028 inflection. CSO Online's coverage of AI in threat detection frames the shift well.

Gartner's seven evaluation questions for AI SOC agents, reported via BleepingComputer, forecast that 50% of TDIR platforms will incorporate agentic AI by 2028 — but only 15% of pilot SOCs achieve measurable improvement without structured evaluation. The market is real but uneven, and the Kings Research AI-powered TDR market sizing and MarketsandMarkets MDR market sizing both support the directional adoption. The buyer takeaway: pilot agentic AI against a defined evaluation rubric (durable retention, mesh-agent architecture, breadth of signal sources), not a vendor-supplied scorecard.

Build vs buy resolves on three axes: existing tool investment, in-house SOC maturity, and integration burden. Self-managed TDIR fits organizations with mature SOCs and material investment in best-of-breed tooling. Converged-platform TDIR fits organizations starting from a SIEM-only or fragmented stack and willing to consolidate. MDR-delivered TDIR fits resource-constrained SOCs (the highest-ROI adopters) and organizations entering new regulatory regimes without time to staff up.

How Vectra AI thinks about TDIR

Vectra AI treats TDIR as a workflow that earns its leverage from signal quality. When the detection layer produces high-fidelity, behaviorally-grounded signals — from NDR for east-west traffic, ITDR for identity, plus EDR and SIEM correlation — investigation compresses, automation can confidently handle containment within regulatory clocks, and post-incident learning has fewer false positives to relitigate. Vectra AI's contribution is Attack Signal Intelligence: detection content built on attacker behavior patterns rather than signature noise, scored against business context, and exposed in an investigation surface that connects detection to response. For a deeper look at how this is packaged, see the Vectra AI platform.

Future trends and emerging considerations

The TDIR landscape will look meaningfully different in 12 to 24 months. Three shifts will drive most of the change.

Agentic AI will move from pilot to default. Gartner's 50%-by-2028 forecast reflects an architecture transition, not a feature add. Expect 2026 RFPs to require evaluation criteria around agent durability, mesh architecture, and human-in-the-loop guardrails. Expect 2027 deployments to package agents as the default Tier-1 layer, with humans reserved for adjudication and exceptional-case investigation. The 15% maturity gap means buyers should pilot rigorously: 70% of large SOCs are forecast to be piloting AI agents by 2028, but only the ones with structured evaluation will see measurable improvement.

Regulatory convergence will tighten response clocks further. DORA enforcement matures through 2026 and 2027. NIS2 enforcement expands as member states finalize transpositions. The SEC disclosure rule continues generating case law that will refine the materiality threshold. Expect new sector-specific rules (energy, healthcare, financial market infrastructure) with clocks at or below the 4-hour DORA classification threshold. TDIR platforms that cannot demonstrate a 4-hour materiality determination workflow will lose competitive ground.

Identity will overtake endpoint as the dominant TDIR pillar. Industry threat intelligence research consistently finds 79% to 80% of attacks are now malware-free, rooted in account compromise. ITDR coverage will become table stakes; EDR-only TDIR will increasingly be miscategorized in vendor evaluations. The Quest KACE-class identity-trigger CVEs from 2025 will look quaint compared to the volume of identity-driven incidents 2027 will surface.

Network detection will keep mattering more, not less. Salt Typhoon's persistence, the supply-chain pattern in the Vimeo and Anodot incident, and the ongoing rise of LOTL and encrypted-channel attacks all point in the same direction: network-level behavioral analytics is irreplaceable for east-west visibility. NDR will increasingly be the signal source that validates ITDR and EDR alerts.

Investment priorities for 2026. Detection engineering as a named function with budget. ITDR coverage where it is missing. NDR coverage where east-west blind spots exist. Agentic AI pilots scoped to specific playbook families (phishing triage, credential reset, isolation) before broad rollout. NCSC-aligned KPI frameworks that retire vanity metrics (ticket closure, rule count) in favor of TTD/TTR and hypothesis-led hunting throughput.

Conclusion

TDIR is best understood as a discipline first and a product category second. The four-phase loop — detection, investigation, response, and post-incident learning — is the durable structure. Everything else (which signal sources you use, whether you run an XDR or a SIEM, whether you self-manage or buy MDR, whether you adopt agentic AI in 2026 or 2028) is a delivery decision. Get the discipline right and the delivery decisions become easier; skip the discipline and no platform will save the program.

The 2026 board conversation should focus on three things: closing identity and network blind spots so detection covers the modern attack surface, building DORA, NIS2, and SEC clocks into response playbooks before the first incident tests them, and adopting agentic AI with structured evaluation rather than vendor-supplied scorecards. The composite outcome — roughly 40% efficiency gains across the TDIR workflow when AI and automation are applied at scale, triangulated from Mandiant, Ponemon, SANS, and Gartner — is real, but only for programs that earn it through discipline.

To go deeper on any of the connected workflows, explore incident response, network detection and response, and identity threat detection and response. For platform-level treatment, see how Vectra AI's TDIR platform brings these threads together.

‍