What is the difference between NDR and a firewall?
A firewall decides which connections are allowed; NDRNDR: network detection and response. Security monitoring that watches the traffic between devices and raises an alert when one behaves like an attacker. watches what happens inside the connections that were allowed. A firewall sits at the edge of the network, or between segments, and enforces rules: this address may reach that server on this port, everything else is refused. It is essential, but an attacker who gets in through a phishing e-mail or a stolen password uses connections the firewall permits, and most firewalls do not watch traffic between devices on the same segment at all. NDR (network detection and response) gets a copy of the traffic and looks for behaviour: a workstation that suddenly talks to many servers, a host calling an outside address every few minutes, data leaving at night. You need both. NetSenX does not filter or block anything; it alerts and explains, and you or your firewall act on the alert.
Read next
Related questions
Terms used here
- NDR (network detection and response)
- Security monitoring that watches the traffic between devices and raises an alert when one behaves like an attacker.