NDR — Network Detection and Response
Concept
Network Detection and Response (NDR) detects threats by analyzing network traffic itself, rather than relying only on logs produced by devices.
NDR is valuable because:
- Every system communicates over the network, including systems that cannot run an agent or do not produce useful logs.
- Attackers must use the network to move between systems, control compromised hosts, or take data out.
- Network traffic is difficult for an attacker to hide or alter after the fact.
NDR receives traffic through packet mirroring and analyzes it passively.
Network Traffic Analysis
Network Traffic Analysis (NTA) is the analysis engine behind NDR. It inspects traffic in real time — with a focus on east-west traffic between internal systems — to find malicious or suspicious activity.
NDR in SentriaOne xSIEM
SentriaOne xSIEM provides ML-based NDR through network traffic analysis.
| Capability | Description |
|---|---|
| Signature-based detection | Traffic is matched against known malicious patterns |
| Anomaly detection | Unusual traffic behaviour is identified using machine learning |
| Deep protocol parsing | Major protocols are decoded for detailed inspection |
| File extraction | Files transferred over the network are extracted for analysis |
| Advanced malware detection | Extracted files are analyzed using machine learning and sandboxing |
Examples of what network analysis can reveal
The examples below describe the kinds of activity that network-based detection is generally designed to find.
| Activity | What it may look like on the network |
|---|---|
| Internal reconnaissance | One host attempting connections to many hosts or ports |
| Lateral movement | Remote administration protocols used between unusual internal systems |
| Command and control | Regular, repeated connections from an internal host to an external one |
| Data exfiltration | Unusually large outbound transfers |
| Malware delivery | A malicious file downloaded over the network |
Detection and response
NDR detections are correlated with other data and passed to Incident Response, where the security team reviews the detection details and decides which action to take.