Network Detection and Response monitors traffic — flows, sessions and protocol metadata — to find malicious behaviour that endpoint and log-based tools miss. It is the answer to a structural problem: not every device can run an agent, and attackers know it.
What NDR sees that EDR cannot
Endpoint agents cover managed workstations and servers. They do not cover medical devices, industrial controllers, printers, cameras, building systems, guest devices or third-party connections. In many organisations, that unmanaged half of the estate is where intrusions persist.
The network is also the only place where certain behaviours are visible at all: internal scanning, lateral movement between hosts, command-and-control beaconing to external infrastructure, and data staging before exfiltration. An attacker can disable an endpoint agent. Removing the network is harder.
How NDR works in practice
Sensors collect traffic from network taps or SPAN ports at key points: boundary links, data-centre cores and critical internal segments. The platform decodes common protocols, builds a baseline of normal communication for hosts, users and services, and then applies analytics to deviations.
Detection categories that matter most in real operations include lateral movement over SMB, RDP and WMI; beaconing with regular intervals and jitter; DNS tunnelling; anomalous data volumes to unusual destinations; and new external connections from sensitive segments. Where policy and privacy allow, TLS metadata and selective decryption extend visibility into encrypted traffic.
NDR vs IDS and IPS
An IDS matches packet signatures and alerts. An IPS blocks inline. Both are valuable against known threats. NDR adds behavioural analytics, asset context and investigation workflows — and it is designed for response, not just alerting. The categories coexist: many organisations keep IPS at the boundary and use NDR for internal behaviour.
A worked example
A workstation that normally talks to a file server and a handful of SaaS endpoints begins connecting to forty internal hosts over port 445 within ten minutes, then resolves a newly registered domain. Each signal alone is ambiguous. Correlated, they describe ransomware staging: discovery, lateral movement and command-and-control resolution. NDR raises this as one incident with evidence, allowing containment before encryption begins.
Where NDR fits in your stack
NDR complements EDR by covering what agents cannot, and feeds XDR correlation with the network dimension. If you are building segmentation or replacing legacy monitoring, our network security services describe how visibility and segmentation are designed together, and the NDR solutions page details detection categories and deployment models.
The strategic point is simple: attackers traverse the network. Defenders should be able to see it.