# Can NDR block attacks or only alert?

It depends on the product; NetSenX alerts and recommends, and does not block traffic by itself. Some NDR products sit in the traffic path or integrate with firewalls to cut connections automatically. That can stop an attack, and it can also stop your production line on a false positive, so automated blocking is usually limited to narrow, well-tested cases. A sensor on a mirror port, which is how most NDR is deployed, only receives a copy of the traffic and cannot block anything itself; the response goes through your firewall, switch, endpoint tool or a person. NetSenX explains each alert, offers manual response actions from the Starter plan and automatic response recommendations from the Pro plan, and never blocks traffic on its own. Deciding to isolate a machine, block an address or reset accounts stays with your team, which is also why every action is kept in the audit log.

FAQ: [NDR, EDR, SIEM, XDR, MDR](https://netsenx.com/en/faq/tools) · https://netsenx.com/en/faq/can-ndr-block-attacks-or-only-alert

## Read next

- https://netsenx.com/en/what-is-ndr
- https://netsenx.com/en/blog/2026-09-24_ndr-vs-edr-vs-siem

## Related questions

- [How do I build an asset inventory from network traffic?](https://netsenx.com/en/faq/how-to-build-an-asset-inventory-from-network-traffic)
- [Does a network map show devices that never send any traffic?](https://netsenx.com/en/faq/does-a-network-map-show-devices-that-never-send-traffic)
- [Is NDR worth it for a small or mid-sized company?](https://netsenx.com/en/faq/is-ndr-worth-it-for-a-small-or-mid-sized-company)
- [What should I ask when evaluating an NDR product?](https://netsenx.com/en/faq/what-to-ask-when-evaluating-an-ndr-product)
- [How do I test that our network detection actually works?](https://netsenx.com/en/faq/how-to-test-that-network-detection-actually-works)