Network Detection and Response

Network Detection and Response (NDR) continuously analyzes network traffic to find attacker behavior that other controls missed, and gives responders the evidence and workflow to act on it. It is a category name for tools built on two older disciplines — network intrusion detection and network behavior analysis — combined with automated response actions and integration into the rest of the security stack.

The useful mental model is a camera that never blinks, pointed at every hallway in the building, not just the front door.

traffic capture → protocol and metadata extraction → detection (signature + behavioral) → alert triage → response
        ↑                                                                                        ↓
        └──────────────────── baseline updated from confirmed-benign activity ───────────────────┘

Firewalls and perimeter controls decide what traffic is allowed in. NDR assumes some of what got allowed in was malicious anyway, and looks for the signs: a compromised host quietly reaching a command-and-control server, a service account moving to systems it never touched before, an attacker using a stolen credential exactly as designed. None of that trips a firewall rule. It shows up in the traffic pattern.

Why NDR matters

Perimeter and endpoint tools cannot see everything an attacker touches: