How does network detection and response work?

It copies the traffic between your devices to a sensor, learns what is normal for each device, and raises an alert when one starts behaving like an attacker. The copy comes from a mirror port on a switch (SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it.), a small hardware tap on a cable, or an agent on the hosts you choose. The sensor does not need to read the content: timing, volume, destinations, ports, DNS answers and the unencrypted parts of the TLSTLS: Transport Layer Security. The encryption that protects most internet traffic, such as HTTPS. handshake are enough to see a machine calling an outside server every few minutes, knocking on many internal hosts, logging in to servers it never used, or sending far more data out than usual. The response part is what your team does with the alert: investigate, isolate the host, reset accounts. NetSenX works this way: it never decrypts traffic, it explains every alert in plain language on every plan, and it leaves the response decision to you. It does not see devices that stay silent or segments you do not mirror.

← All 40 questions on NDR, EDR, SIEM, XDR, MDRAll topics