NDR Network Detection & Response

NDR (network detection and response) is a solution that adds context to security threats. Features such as network traffic analysis and the real-time inspection of network communications allow NDR solutions to detect and investigate threats, anomalous behaviours and risky activity across all the corners of your network. NDR acts as a virtual forensic expert that has the capability to understand the exact scope and peculiarities of a security incident or breach.

NDR solutions harness the strengths and virtually unlimited capabilities of high-end AI, machine learning and deep learning to provide predictive risk analysis. When you are dealing with large amounts of poorly contextualised alarms, NDR is often a better fit than SIEM.

The solutions typically provide centralised, machine-based network traffic analysis and response solutions, including efficient workflows and automation. The positioning in the network and help from machine learning provides a full insight and analysis of the network in order to identify and eliminate lateral movements in particular.

• Scope: Network and inter-device traffic
• Intention: Visibility/transparency of network traffic, detection of known and unknown threats and lateral movements, alerting and response
• Methods: Indicator of Attack (IoA), anomaly detection, user behaviour, machine learning
• Challenges: Advanced attacks and intrusions, malware-free attacks