Network Detection and Response
Network Detection and Response (NDR) is a category of security tools that watches the traffic moving across a network to spot attackers who have already gotten past other defenses, then helps a security team investigate and contain them.
itDefensive security and security operations | OpenSkills.info
Course pathWalk it in order
Look it upDip in anytime
Go furtherLeaves this page
Intro
Network Detection and Response
Network Detection and Response (NDR) continuously analyzes network traffic to find attacker behavior that other controls missed, and gives responders the evidence and workflow to act on it. It is a category name for tools built on two older disciplines — network intrusion detection and network behavior analysis — combined with automated response actions and integration into the rest of the security stack.
The useful mental model is a camera that never blinks, pointed at every hallway in the building, not just the front door.
traffic capture → protocol and metadata extraction → detection (signature + behavioral) → alert triage → response
↑ ↓
└──────────────────── baseline updated from confirmed-benign activity ───────────────────┘
Firewalls and perimeter controls decide what traffic is allowed in. NDR assumes some of what got allowed in was malicious anyway, and looks for the signs: a compromised host quietly reaching a command-and-control server, a service account moving to systems it never touched before, an attacker using a stolen credential exactly as designed. None of that trips a firewall rule. It shows up in the traffic pattern.
Why NDR matters
Perimeter and endpoint tools cannot see everything an attacker touches:
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://csrc.nist.gov/pubs/sp/800/94/final
Supports
- The four IDPS technology classes: network-based, wireless, network behavior analysis, and host-based
- Signature, anomaly, and stateful protocol analysis as IDPS detection methods
- The distinction between detection and inline prevention
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-278a
Supports
- The operational consequences of insufficient network monitoring and segmentation
- Assessment findings involving undetected lateral movement and command and control
- https://www.cisa.gov/resources-tools/resources/enhanced-visibility-and-hardening-guidance-communications-infrastructure
Supports
- Network visibility, flow monitoring, packet capture, and encrypted-traffic monitoring tradeoffs
- The importance of internal monitoring and segmentation
- https://attack.mitre.org/resources/updates/updates-october-2025/
Supports
- ATT&CK v18 Detection Strategies and Analytics replacing technique detections
- Deprecation of the Data Sources model
- https://mitre-attack.github.io/attack-data-model/docs/principles/attack-detections/
Supports
- Detection Strategies as high-level approaches and Analytics as platform-specific implementations
- Data Components continuing as telemetry inputs to the detection model
- https://d3fend.mitre.org/technique/d3f:NetworkTrafficAnalysis/
Supports
- Network Traffic Analysis definition and its 21 subordinate techniques
- Protocol metadata anomaly detection, certificate analysis, payload profiling, DNS analysis, and upload-download ratio analysis
- https://docs.zeek.org/en/current/about/monitoring.html
Supports
- Network security monitoring using high-fidelity transaction logs from traffic
- Network telemetry as a complement to host-based telemetry
- https://suricata.io/
Supports
- Suricata as an IDS, IPS, and network security monitoring engine
- Reference-path rationale for deployable signature and protocol detection software
- https://csrc.nist.gov/pubs/sp/800/137/final
Supports
- Continuous monitoring as an organizational capability, not a single tool
- Reference-path rationale for NDR program design
- https://github.com/caesar0301/awesome-pcaptools
Supports
- Curation of PCAP analysis and inspection tools used for the Awesome Links selection
- Wireshark, Arkime, NetworkMiner, Zui, Scapy, and tcpdump as ecosystem tools
- https://www.wireshark.org/
Supports
- Wireshark as a packet analyzer for inspection and forensic drill-down
- https://arkime.com/
Supports
- Arkime as indexed packet capture and session search
- https://www.netresec.com/?page=NetworkMiner
Supports
- NetworkMiner as a network forensic analysis tool for packet captures
- https://zui.brimdata.io/
Supports
- Zui as a desktop application for exploring packet captures and Zeek logs
- https://scapy.net/
Supports
- Scapy as a programmable packet manipulation tool
- https://www.tcpdump.org/
Supports
- tcpdump and libpcap as core packet-capture tooling