Network Detection and Response
Network Detection and Response (NDR) is a category of security tools that watches the traffic moving across a network to spot attackers who have already gotten past other defenses, then helps a security team investigate and contain them.
itDefensive security and security operations | OpenSkills.info
Course pathWalk it in order
Look it upDip in anytime
Go furtherLeaves this page
Don't Panic
Don't Panic - Network Detection and Response
Network Detection and Response (NDR) watches network traffic continuously so you can find attacker behavior other controls missed, then act with evidence. The category sits on older work: network intrusion detection and network behavior analysis, joined to triage and response workflows.
Think of a camera that never blinks, pointed at every hallway, not only the front door. Capture or mirror feeds arrive at sensors. Sensors extract protocol metadata and payloads where policy allows. Detection mixes signatures with behavioral baselines. Alerts reach humans or automation. Response may isolate a host, block a flow, or enrich an incident in the wider security stack.
Two traffic directions matter. North-south crosses the perimeter. East-west moves between internal systems, which is where lateral movement lives. If you only instrument the edge, an attacker who already holds one internal host can roam while your dashboards stay calm. Visibility is therefore a placement problem before it is a model problem.
Detection quality depends on what the sensor can see and how current the baseline is. Blind spans create false calm. Noisy baselines create false storms after every release. Start by proving capture coverage against trust boundaries, then tune rules against confirmed paths. Keep response actions bounded: automated blocks help when confidence is high and rollback is clear; uncertain cases stay with analysts.
Read the Intro for the capture-to-response path and the east-west emphasis. Use the Cheatsheet when you need the term map for sensors, baselines, and response hooks. Updates tracks NIST SP 800-94, the vendor-neutral IDS and monitoring foundation this course uses.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://csrc.nist.gov/pubs/sp/800/94/final
Supports
- The four IDPS technology classes: network-based, wireless, network behavior analysis, and host-based
- Signature, anomaly, and stateful protocol analysis as IDPS detection methods
- The distinction between detection and inline prevention
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-278a
Supports
- The operational consequences of insufficient network monitoring and segmentation
- Assessment findings involving undetected lateral movement and command and control
- https://www.cisa.gov/resources-tools/resources/enhanced-visibility-and-hardening-guidance-communications-infrastructure
Supports
- Network visibility, flow monitoring, packet capture, and encrypted-traffic monitoring tradeoffs
- The importance of internal monitoring and segmentation
- https://attack.mitre.org/resources/updates/updates-october-2025/
Supports
- ATT&CK v18 Detection Strategies and Analytics replacing technique detections
- Deprecation of the Data Sources model
- https://mitre-attack.github.io/attack-data-model/docs/principles/attack-detections/
Supports
- Detection Strategies as high-level approaches and Analytics as platform-specific implementations
- Data Components continuing as telemetry inputs to the detection model
- https://d3fend.mitre.org/technique/d3f:NetworkTrafficAnalysis/
Supports
- Network Traffic Analysis definition and its 21 subordinate techniques
- Protocol metadata anomaly detection, certificate analysis, payload profiling, DNS analysis, and upload-download ratio analysis
- https://docs.zeek.org/en/current/about/monitoring.html
Supports
- Network security monitoring using high-fidelity transaction logs from traffic
- Network telemetry as a complement to host-based telemetry
- https://suricata.io/
Supports
- Suricata as an IDS, IPS, and network security monitoring engine
- Reference-path rationale for deployable signature and protocol detection software
- https://csrc.nist.gov/pubs/sp/800/137/final
Supports
- Continuous monitoring as an organizational capability, not a single tool
- Reference-path rationale for NDR program design
- https://github.com/caesar0301/awesome-pcaptools
Supports
- Curation of PCAP analysis and inspection tools used for the Awesome Links selection
- Wireshark, Arkime, NetworkMiner, Zui, Scapy, and tcpdump as ecosystem tools
- https://www.wireshark.org/
Supports
- Wireshark as a packet analyzer for inspection and forensic drill-down
- https://arkime.com/
Supports
- Arkime as indexed packet capture and session search
- https://www.netresec.com/?page=NetworkMiner
Supports
- NetworkMiner as a network forensic analysis tool for packet captures
- https://zui.brimdata.io/
Supports
- Zui as a desktop application for exploring packet captures and Zeek logs
- https://scapy.net/
Supports
- Scapy as a programmable packet manipulation tool
- https://www.tcpdump.org/
Supports
- tcpdump and libpcap as core packet-capture tooling