Does NDR work on encrypted traffic?
Yes, within limits. Timing, volume, destinations and the TLSTLS: Transport Layer Security. The encryption that protects most internet traffic, such as HTTPS. handshake stay visible without decryption, and they are enough to spot beaconing, scanning or unusual uploads. Without decryption, no NDRNDR: network detection and response. Security monitoring that watches the traffic between devices and raises an alert when one behaves like an attacker. can read the content of a session. NetSenX never decrypts.
This answer also appears, with more context, here: What is NDR?
Read next
Related questions
Terms used here
- TLS (Transport Layer Security)
- The encryption that protects most internet traffic, such as HTTPS.
- NDR (network detection and response)
- Security monitoring that watches the traffic between devices and raises an alert when one behaves like an attacker.