What is Network Detection and Response (NDR)?
Network Detection and Response (NDR) is a security technology category that monitors network traffic to detect threats, investigate incidents, and trigger automated or analyst-driven responses. It is used to find attacks that bypass perimeter controls by analyzing raw packets, flow data, and protocol behavior across on-premises and cloud networks.
What it does
NDR platforms sit on the network and watch traffic continuously. They ingest raw packets, NetFlow records, or metadata from taps, span ports, or packet brokers. From that data they:
- Classify protocols and applications, often using deep packet inspection (DPI) up to Layer 7
- Build behavioral baselines for devices, users, and traffic patterns
- Alert on deviations such as unusual lateral movement, beaconing, or data exfiltration
- Store traffic records so analysts can replay or query past sessions
- Trigger automated blocks, quarantines, or firewall rule changes in response to confirmed threats
Some platforms analyze full packet captures (PCAPs). Others work from metadata only, which reduces storage costs but limits forensic depth. Managed variants handle the monitoring and threat hunting on behalf of the customer.
Why teams buy it
Perimeter tools like next-generation firewalls and intrusion detection and prevention systems (IDPS) miss threats that move east-west inside the network or that use encrypted channels. NDR gives visibility into that internal traffic. It also provides a forensic record that endpoint tools cannot supply for network-only devices such as OT sensors, printers, or IoT hardware. Teams use NDR to shorten the time between attacker entry and detection, and to gather evidence for incident response.
What to look for
- Coverage: Does it handle cloud traffic, OT/IoT protocols, and encrypted traffic, not just traditional IT segments?
- Detection methods: Look for a mix of signature-based rules, behavioral analytics, and machine learning models.
- Retention and forensics: How long are packets or metadata stored? Can analysts query historical traffic?