# How does network detection and response work?

It copies the traffic between your devices to a sensor, learns what is normal for each device, and raises an alert when one starts behaving like an attacker. The copy comes from a mirror port on a switch (SPAN), a small hardware tap on a cable, or an agent on the hosts you choose. The sensor does not need to read the content: timing, volume, destinations, ports, DNS answers and the unencrypted parts of the TLS handshake are enough to see a machine calling an outside server every few minutes, knocking on many internal hosts, logging in to servers it never used, or sending far more data out than usual. The response part is what your team does with the alert: investigate, isolate the host, reset accounts. NetSenX works this way: it never decrypts traffic, it explains every alert in plain language on every plan, and it leaves the response decision to you. It does not see devices that stay silent or segments you do not mirror.

FAQ: [NDR, EDR, SIEM, XDR, MDR](https://netsenx.com/en/faq/tools) · https://netsenx.com/en/faq/how-does-network-detection-and-response-work

## Read next

- https://netsenx.com/en/what-is-ndr
- https://netsenx.com/en/blog/2026-09-24_ndr-vs-edr-vs-siem

## Related questions

- [What is the difference between NDR, EDR and SIEM?](https://netsenx.com/en/faq/what-is-the-difference-between-ndr-edr-and-siem)
- [What do EDR, NDR, XDR and MDR mean in plain words?](https://netsenx.com/en/faq/edr-ndr-xdr-mdr-explained-in-plain-words)
- [Does NetSenX replace my EDR or SIEM?](https://netsenx.com/en/faq/does-netsenx-replace-my-edr-or-siem)
- [Do I need NDR if I already have EDR?](https://netsenx.com/en/faq/do-i-need-ndr-if-i-already-have-edr)
- [EDR or NDR: which should a small company buy first?](https://netsenx.com/en/faq/edr-or-ndr-which-should-a-small-company-buy-first)