Definition

What is network detection and response (NDR)?

Network detection and response (NDR) is security monitoring that watches the traffic between devices, learns what normal behaviour looks like and raises an alert when a host starts to behave like an attacker: scanning, moving to other machines, checking in with an outside server at regular intervals or sending unusual volumes of data out. Because it reads traffic rather than running on each device, it also covers machines that cannot run an agent, such as printers, cameras and industrial controllers. The response half is what the team, or an automated playbook, does with the alert.

The fact to plan around

In joint guidance published on 7 February 2024, CISA, the NSA, the FBI and partner agencies recommended keeping baselines of normal network, user and administrative activity and investigating what deviates from them, because attackers who "live off the land" use the same legitimate tools as administrators and blend in with normal operations.

Source: CISA, NSA, FBI and partner agencies — Joint guidance: Identifying and mitigating living off the land techniques, 7 February 2024 (published by NCSC New Zealand)

What your sensor can and cannot see

A network sensor sees only the traffic it is given. Tick the segments of your network that are mirrored to a NetSenX agent through a SPAN or TAP port, and see which situations become visible and which stay dark.

8 of 16 situations visible with these segments.

  • Office

    Visible

    • Command-and-control beaconing from an office PC
    • Unusual uploads from a workstation
    • Traffic from office devices to AI services (from Pro)
    • A new or unknown device on the network map

  • Servers

    Visible

    • Lateral movement to the file servers
    • Ransomware staging on file shares
    • Password guessing against a server
    • An archive leaving for an unknown destination

  • Guest Wi-Fi

    Not visible: not mirrored

    • A guest device scanning the network

  • Production

    Not visible: not mirrored

    • Writes to a PLC outside the usual pattern (from Pro)
    • Traffic crossing the levels of the plant network (from Pro)
    • OT activity outside working hours (from Pro)

  • Building systems

    Not visible: not mirrored

    • A camera or building controller phoning home
    • A building controller scanning other devices

  • Remote laptops

    Not visible: not mirrored

    • Beaconing from a laptop away from the office
    • Unusual uploads from a laptop at home

Never visible to a network sensor

  • Files copied to a USB stick
  • A sign-in with a valid, stolen password
  • File names and content inside encrypted sessions
  • What an e-mail says, phishing included
Show the segments as a table
SegmentWhat becomes visible
Office (Mirrored to a NetSenX agent)Command-and-control beaconing from an office PC; Unusual uploads from a workstation; Traffic from office devices to AI services (from Pro); A new or unknown device on the network map
Servers (Mirrored to a NetSenX agent)Lateral movement to the file servers; Ransomware staging on file shares; Password guessing against a server; An archive leaving for an unknown destination
Guest Wi-Fi (Mirrored to a NetSenX agent)A guest device scanning the network
Production (Mirrored to a NetSenX agent)Writes to a PLC outside the usual pattern (from Pro); Traffic crossing the levels of the plant network (from Pro); OT activity outside working hours (from Pro)
Building systems (Mirrored to a NetSenX agent)A camera or building controller phoning home; A building controller scanning other devices
Remote laptops (NetSenX agent on each laptop)Beaconing from a laptop away from the office; Unusual uploads from a laptop at home

Laptops away from the office are visible only with an agent on the laptop itself. What a sensor cannot see needs another tool: endpoint protection for USB copies and programs, your identity provider and VPN logs for sign-ins, your mail filter for phishing.

How NDR works, in four steps

The same four steps apply to any NDR product. How each step is done differs from vendor to vendor.

  1. 01Capture

    A sensor receives a copy of the traffic from a SPAN or TAP port, or reads it on a host, and records flow metadata: who connected to whom, when, how much data moved and over which protocol.

  2. 02Baseline

    It learns what is normal for each host and segment: the usual destinations, ports, volumes and times of day.

  3. 03Detect

    It scores deviations that match attacker behaviour, such as scanning, lateral movement, beaconing or data exfiltration. Many products work from metadata and the TLS handshake, so encrypted traffic stays useful without decryption; some decrypt traffic instead.

  4. 04Respond

    An analyst investigates the alert, or a playbook isolates a host or blocks a destination. The record of what was seen and done feeds the incident report.

What NetSenX does today

  • Detects scanning, lateral movement, C2 beaconing and unusual outbound data volume from network behaviour, on every plan, Free included.
  • Sees devices that run no agent, such as printers, cameras and controllers, because one agent on a SPAN or TAP port watches the whole segment.
  • Analyses encrypted traffic from timing, volume and destinations, and from the Starter plan also from the TLS handshake, and never decrypts it. The handshake is visible only where the agent captures packets: on Linux or as a sensor on a SPAN or TAP port, not in the basic mode used on macOS.
  • Explains every alert in plain language, listing the network features that drove its score, and runs automated responses only from playbooks your team writes or copies from NetSenX templates.

What NetSenX does not do

NetSenX does not see what happens inside a host without touching the network, such as a process that never connects anywhere; endpoint protection (EDR) covers that ground. It sees only the segments you monitor. It never decrypts traffic, so it cannot read the content of an encrypted session, and it does not replace incident response. An alert is a reason to investigate, not proof of an intrusion.

Questions buyers ask

What does NDR stand for?

Network detection and response: security tools that analyse the traffic between devices to detect attacker behaviour and support the response to it. Earlier products in the same space were often called network traffic analysis (NTA).

What is the difference between NDR, EDR and SIEM?

EDR runs on each endpoint and sees the processes and files on that machine. A SIEM collects logs from many systems and correlates them. NDR watches the traffic between devices, so it also covers devices that cannot run an agent and activity that leaves no log. The three complement each other.

Does NDR work on encrypted traffic?

Yes, within limits. Timing, volume, destinations and the TLS handshake stay visible without decryption, and they are enough to spot beaconing, scanning or unusual uploads. Without decryption, no NDR can read the content of a session. NetSenX never decrypts.

Is NDR worth it for a small or mid-sized company?

Small teams rarely have time to read firewall and DNS logs every day, and attackers who use legitimate administration tools leave few traces elsewhere. NDR watches the traffic continuously and raises what deviates. NetSenX has a Free plan, so a team can try it on its own network before paying.

Sources

  1. CISA, NSA, FBI and partner agencies — Joint guidance: Identifying and mitigating living off the land techniques, 7 February 2024 (published by NCSC New Zealand)
  2. RFC 8446 — The Transport Layer Security (TLS) Protocol Version 1.3, IETF, August 2018 (section 1.2)
  3. MITRE ATT&CK — Lateral Movement (TA0008)

This page is general information, not legal advice. Check your obligations with your national authority or legal counsel.

Related pages

Try NetSenX on your own network

Start on the Free plan with up to 3 devices, or book a 20-minute demo.

See pricingBook a demo