EDR protects the devices you can install an agent on, a SIEM collects and correlates logs from everything that produces them, and NDR watches the network traffic between all devices — including the ones that run no agent at all. For an IT team without a security operations centre (SOC), the practical order is usually EDR on every managed endpoint first, then NDR for the traffic and devices EDR cannot see, and a SIEM once someone has the time to write rules and read logs every day.
What each tool watches
| EDR | SIEM | NDR | |
|---|---|---|---|
| Watches | Processes, files and memory on managed endpoints | Logs from servers, firewalls, cloud services and applications | Network traffic between hosts, inside and out |
| Catches well | Malware executing on a laptop or server; ransomware behaviour on the host | Correlations across many systems; long-term retention; audit reporting | Command-and-control beaconing, scanning, lateral movement, unusual outbound data |
| Blind spots | Devices without an agent: printers, cameras, IoT, OT controllers, unmanaged laptops | Anything that does not write a log, or writes one nobody collects | What happens inside a host without touching the network; encrypted payload content |
| Effort to run | Low to medium | High: parsing, rules and tuning never stop | Low to medium |
| Usual pricing basis | Per endpoint | Per volume of data ingested | Per monitored device, sensor or bandwidth |
The three overlap less than it may seem. An attacker who lands on an unmanaged device is invisible to EDR, and a SIEM only sees it if something logs the activity. The same attacker still has to talk over the network — to a command-and-control server, to other hosts, to wherever the data goes — and that is what NDR sees. The MITRE ATT&CK framework lists lateral movement and command and control as distinct attacker tactics for exactly this reason: they happen between machines.
What to add first without a SOC
- EDR on every endpoint you manage. It blocks and records malicious activity on the host, and needs little daily attention once deployed.
- NDR for the network. It covers the devices EDR cannot, shows lateral movement between hosts, and gives you the incident timeline NIS2 reporting needs. Choose one whose alerts explain themselves: without analysts, an alert with no reason attached is an alert nobody acts on.
- A SIEM when you can staff it. A SIEM pays off when someone owns it — writing correlation rules, keeping parsers working and reviewing logs every day. Until then, the logs your regulator requires can often be kept without a full SIEM deployment.
- Consider MDR if you need 24/7 eyes. A managed detection and response service is people, not a tool: a provider watches your EDR, NDR or SIEM alerts around the clock.
Questions to ask before you buy an NDR
- Does every alert say, in plain language, why it fired?
- Is there a stated false-positive bound, and can you verify it on your own data?
- Is the price list published, or is every deployment quoted?
- Where is the monitoring data stored, and under which data processing agreement?
- Can it read OT protocols passively, without probing controllers?
Our NDR vendor comparisons apply these questions to Darktrace, Vectra AI, ExtraHop and Nozomi Networks, with sources for every statement.
Where NetSenX fits
NetSenX is a Network Detection and Response (NDR) platform for EU mid-market organisations that detects attacks from network behaviour, explains every alert in plain language and keeps customer data in the EU. It works alongside EDR and SIEM, not instead of them: from the Business plan, alerts can be exported to the SIEM you already run. The Free plan covers up to 3 devices with no time limit, so you can see what it finds before deciding. Details are on the pricing page and in the FAQ. If NIS2 applies to you, the NIS2 network monitoring checklist is the next read.
Sources
- MITRE ATT&CK — Lateral Movement (TA0008)
- MITRE ATT&CK — Command and Control (TA0011)
- NIST SP 800-94, Guide to Intrusion Detection and Prevention Systems
Written by the NetSenX Team at TriStiX S.L. Questions: info@netsenx.com.
Questions this guide answers
What is the difference between NDR, EDR and SIEM?
EDR runs on each endpoint and sees the processes and files on that machine. A SIEM collects logs from many systems and correlates them. NDR watches the traffic between devices, so it also covers devices that cannot run an agent and activity that leaves no log. The three complement each other.
What do EDR, NDR, XDR and MDR mean in plain words?
EDR watches each computer from the inside, NDR watches the traffic between devices, XDR puts several sources in one console, and MDR is a team that watches the alerts for you. EDR (endpoint detection and response) is software installed on laptops and servers that sees processes, files and memory on that machine. NDR (network detection and response) is a sensor that sees how devices talk to each other, including printers, cameras and machines where no software can be installed. XDR (extended detection and response) is a platform that combines endpoint, e-mail, identity, cloud and sometimes network signals. MDR (managed detection and response) is not software at all but a service: people who read the alerts around the clock and act. You will also see SIEM (security information and event management), which collects logs. NetSenX is an NDR; it works alongside the others and does not replace them.
What is XDR, and is it the same as NDR?
No. XDR (extended detection and response) is a platform that combines signals from several sources in one console, while NDR (network detection and response) is one of those possible sources. Most XDR products are built around an endpoint agent and add e-mail, identity and cloud logs; some add network data, some do not. The difference matters for devices that cannot run an agent, such as printers, cameras, building systems, machines and appliances: an XDR built only on endpoints does not see them unless network data is fed in. Before you buy, ask which sources the XDR really ingests in your licence, not in the brochure. NetSenX is an NDR: it watches the traffic between devices and raises beaconing, scanning, lateral movement and unusual outbound volume on every plan, Free included. It does not replace an EDR or an XDR platform, and from the Business plan its alerts can be exported to the SIEM or XDR you already run.
What is the difference between MDR and EDR?
EDR is software, MDR is a service run by people. EDR (endpoint detection and response) is installed on your computers and servers; it watches processes and files, raises alerts and lets an administrator isolate a machine. Someone still has to read those alerts and decide. MDR (managed detection and response) is a provider whose analysts read the alerts for you, around the clock, and respond within an agreed time. Most MDR services bring or require their own EDR, and some also take network or cloud data. So the real question is not EDR or MDR, but who reads the alerts at night. If you have staff or an IT provider on call, EDR plus network detection may be enough. If nobody can react outside office hours, a managed service fills that gap. NetSenX is detection software, not an MDR: it explains each alert so that your team or provider can act on it.
Do I need NDR if I already have EDR?
Often yes, because EDR and NDR fail in different places. EDR (endpoint detection and response) only sees machines where its agent runs and is healthy. It does not see printers, cameras, phones on the Wi-Fi, building systems, machines or a contractor's laptop, and attackers often switch it off first on the machine they take over. NDR (network detection and response) watches the traffic between devices, so it still sees a compromised host calling an outside server, scanning the network or copying data out, whatever happens to its endpoint agent. If your company is a handful of laptops with everything in the cloud, EDR and good backups may be enough for now. If you have a local network with servers and devices you cannot install anything on, NDR fills the gap. NetSenX raises beaconing, scanning, lateral movement and unusual outbound volume on every plan, Free included, so you can see what it adds on your own network before paying.
What gaps does EDR leave that only the network shows?
Devices without an agent, agents that have been switched off, and the traffic pattern of an attack spread over several machines. EDR (endpoint detection and response) reports from inside each computer where it runs. It cannot report from a printer, a camera recorder, a NAS, a building controller, a guest phone or an unmanaged laptop someone plugged in. It cannot report from a server where it was uninstalled or tampered with. And each agent sees one host, so a slow pattern that only makes sense across many hosts, such as one machine touching dozens of file shares or quietly calling out every five minutes, is easy to miss. The network sees all of these because every device has to talk to do harm. NetSenX watches that traffic and keeps a network map of the devices it sees. It does not see inside a host, so the two tools complement each other.
Do I need a SIEM if I have NDR?
Not necessarily: many small and mid-sized companies get more from NDR plus good endpoint protection than from a SIEM nobody has time to tune. A SIEM (security information and event management) collects and correlates logs from many systems: firewalls, servers, directories, cloud services. It is powerful when someone writes and maintains its searches, and heavy when nobody does. NDR (network detection and response) gives detections from network traffic without log engineering. The two answer different questions: the SIEM tells you who logged in where, NDR tells you what the devices did on the network. You may need a SIEM anyway if an auditor, a customer contract or a regulator expects central log retention, or once you have staff to use it. If you already run one, NDR alerts can feed it: NetSenX has SIEM export from the Business plan, so network detections arrive in the SIEM already explained.