Network detection and response (NDR) is a security tool that analyzes copies of network traffic to spot attacker behavior such as scanning, lateral movement, and command-and-control, and gives analysts the evidence to investigate. Because it watches what devices say to each other instead of running on each device, it can cover servers, IoT, and unmanaged equipment where agents cannot be installed. This article explains how NDR works, where it stops, and how it fits with EDR, XDR, and SIEM.
What NDR is
NDR combines four building blocks. The term comes from the security industry rather than a standards body, so check what each product actually includes.
- Sensors: passive collectors that receive a copy of traffic from a network tap, a switch mirror port (SPAN), or a cloud mirroring feature
- Network evidence: flow records or richer protocol metadata (DNS, TLS, SMB and so on), and in some products raw packets
- Analytics: signatures for known threats, plus statistical and behavioral detection for activity that no signature describes
- Investigation and response: a timeline of what a host talked to, plus hand-off to other tools that can act
What network traffic can reveal
MITRE ATT&CK describes network traffic as data transmitted across a network that is either summarized, for example NetFlow, or captured raw, for example PCAP. Two ATT&CK tactics show why that data matters. Lateral Movement covers techniques for entering and controlling remote systems on a network, and Command and Control covers how an adversary communicates with compromised systems, with techniques such as Encrypted Channel, Protocol Tunneling, and Non-Standard Port.
MITRE D3FEND, the defensive counterpart to ATT&CK, defines Network Traffic Analysis as analyzing intercepted or summarized traffic to detect unauthorized activity. Its techniques map well to what NDR products do:
- Scanning and discovery: connection attempt analysis looks at failed connections to find network scanning
- Lateral movement: remote terminal session detection and administrative network activity analysis compare internal admin traffic with a baseline
- Command and control: relay pattern analysis, DNS traffic analysis, and certificate analysis look for an internal host acting as a relay or talking to a suspicious domain
- Data theft: per-host download-upload ratio analysis flags hosts that send out unusually large amounts of data
How NDR works
A sensor sits out of band, so it does not slow the network and cannot break it. In the cloud, the equivalent is a mirroring feature; for example, AWS documents VPC Traffic Mirroring as a way to copy interface traffic to out-of-band appliances for content inspection and threat monitoring. The sensor turns packets into structured records for analytics.
Products differ in the details, so compare them using their own documentation. ExtraHop describes passive sensors that decode traffic into structured records, and treats ML-based anomaly detection as a core feature. Vectra's documentation describes sensors that forward metadata to a "Brain" component that runs detection locally, with a rolling capture buffer from which packets can be retrieved on request. Open-source engines show the same ideas in the open: Zeek describes itself as a passive network monitor that writes detailed structured logs, and Suricata is an IDS, IPS, and network security monitoring engine.
Detection typically uses three methods together:
- Signatures: fast and precise for known threats, blind to new ones
- Protocol and metadata anomalies: statistical outliers in how a protocol is used, such as a DNS pattern no other host produces
- Behavioral baselines: learning which hosts normally talk to each other and flagging deviations. Many vendors use machine learning here, so ask how a detection can be explained to an analyst
Because passive sensors are not in line, they do not block traffic themselves. Response usually means sending context to EDR, firewall, SIEM, or SOAR tools. Ask which response actions are native and which need an integration.
Strengths and limits
Strengths
- Coverage without agents: sees servers, IoT, and unmanaged devices that cannot run software
- Hard for an attacker to disable: an attacker who controls a host cannot easily stop a sensor on the network from seeing that host's traffic
- East-west visibility: shows movement between internal systems that a perimeter firewall never sees
- Useful evidence: records of who talked to whom, when, and how much
Limits
- Encryption: payloads in encrypted sessions are unreadable without decryption. Metadata, certificates, timing, and volume remain, and some vendors offer decryption, but it needs key access, adds privacy and legal questions, and varies by product
- Placement: it only sees traffic you feed it. Cloud mirroring is billed per active session, with data transfer charges and a limited list of supported instance types in AWS's case
- No host detail: it does not show which process or file caused the traffic, so pair it with EDR
- Tuning and storage: baselines need time, and keeping metadata or packets costs storage
NDR compared with IDS, EDR, XDR, and SIEM
NIST SP 800-94, published in 2007, already described four classes of intrusion detection and prevention systems, including network-based and network behavior analysis. Modern NDR overlaps with those ideas and adds richer metadata and analytics.
- IDS and IPS: usually signature-driven alerts and, for IPS, blocking in line. NDR emphasizes behavior, context, and investigation
- EDR: deep detail on a single host, but only where an agent is installed. NDR covers everything on the wire, with less detail per host
- XDR: correlates signals from several domains, and many XDR products treat network data as one input. See SIEM, SOAR and XDR compared
- SIEM: collects logs from everywhere and keeps long-term records. NDR is a high-value source for it, not a replacement
How to adopt NDR
NDR is a good fit when you have many unmanaged devices, flat networks, regulated data centers, or OT segments where agents are a poor idea. For OT, see Zero Trust for OT. A pilot usually works best in this order:
- Define the goal: which attacks and which networks matter most
- Map coverage to ATT&CK: list the techniques you most need to see and check each vendor against that list
- Place sensors: internet edge, data center east-west links, key cloud networks, and sensitive segments
- Test with realistic traffic: replay known attack patterns or run an exercise, as described in Network and Cyber Security Simulators
- Integrate and tune: feed alerts to the SIEM or SOAR, define who triages them, and tune before widening scope
Segmentation makes NDR more effective, because fewer allowed paths means clearer anomalies; see Network Segmentation: How to Do It.
Common mistakes
- Expecting it to see inside every encrypted session: plan around metadata and decide deliberately whether decryption is acceptable
- Putting sensors only at the perimeter: most lateral movement never crosses it
- Buying on a demo: insist on a proof of value with your own traffic
- Treating machine learning as a guarantee: ask for explanations and measure false positives
- No owner for alerts: a new alert source without triage ownership just adds noise
- Ignoring data protection: define who can see captured traffic and how long it is kept
Start today
- List the unmanaged devices and network segments where you have no agent coverage
- Check what you already have: your firewalls, switches, or cloud may already export flow data or mirror traffic
- Pick three ATT&CK techniques (for example Remote Services, Encrypted Channel, and Protocol Tunneling) and ask what would show them on your network today
- Test an open-source sensor in a lab segment to see what Zeek or Suricata records
To see where visibility gaps matter most for your organization, try the self-assessment.
References and further reading
- MITRE ATT&CK: Network Traffic data source: how ATT&CK defines summarized and raw network traffic
- MITRE D3FEND: Network Traffic Analysis: defensive techniques that map to NDR functions
- MITRE ATT&CK: Lateral Movement: techniques an attacker uses to move between systems
- NIST SP 800-94: Guide to Intrusion Detection and Prevention Systems: the 2007 baseline guide, including network behavior analysis
- Zeek: open-source passive network monitor and log generator
- Suricata documentation: open-source IDS, IPS, and network security monitoring engine
- AWS: Traffic Mirroring: an example of cloud traffic mirroring for out-of-band inspection
- ExtraHop RevealX: how it works: one vendor's description of passive sensors and analytics (marketing page, treat claims as vendor claims)
- Vectra documentation: architecture overview: another vendor's sensor and Brain design