Can NDR block attacks or only alert?

It depends on the product; NetSenX alerts and recommends, and does not block traffic by itself. Some NDRNDR: network detection and response. Security monitoring that watches the traffic between devices and raises an alert when one behaves like an attacker. products sit in the traffic path or integrate with firewalls to cut connections automatically. That can stop an attack, and it can also stop your production line on a false positive, so automated blocking is usually limited to narrow, well-tested cases. A sensor on a mirror port, which is how most NDR is deployed, only receives a copy of the traffic and cannot block anything itself; the response goes through your firewall, switch, endpoint tool or a person. NetSenX explains each alert, offers manual response actions from the Starter plan and automatic response recommendations from the Pro plan, and never blocks traffic on its own. Deciding to isolate a machine, block an address or reset accounts stays with your team, which is also why every action is kept in the audit log.

← All 40 questions on NDR, EDR, SIEM, XDR, MDRAll topics