Network Detection and Response (NDR)

Executive Summary

Network detection and response (NDR) is a security solution that monitors, detects, and responds to incidents on a network level. Instead of installing an agent like with the EDR, the NDR analyzes the communication between endpoints and can respond to threats detected on a network layer.

Here’s how it works:

1. Monitoring: NDR solutions record the activities and events taking place on the network and in the communication between the endpoints, providing security teams with the visibility they need to uncover incidents.
2. Detection: NDR uses various data analytics techniques to detect suspicious system behavior. It can recognize threats and determine what kind of threat it is.
3. Response: Once a threat is detected, EDR provides remediation suggestions to handle the affected systems. 
4. Threat Hunting: NDR allows for proactive defense. Threat hunters work to hunt, investigate, and advise on threat activity in the environment.

In essence, NDR is like a security guard who constantly watches over your network, ready to detect and respond to any potential threats. It’s a crucial part of modern cybersecurity strategies, helping to protect your organization’s information and systems from cyber threats.

Network Detection and Response

Monitoring

The NDR agent constantly monitors the communication between the network’s endpoints and reports when patterns or endpoint behavior appear to be malicious. It manages this by analyzing the data packets that flow on the network. NDR usually has the capability to store packet information for retrieval later.

Detection

The NDR can be compared to older intrusion detection or prevention systems, but it has far more capabilities to detect security threats using pattern recognition, machine learning, and AI.

Response

NDR usually requires a connection to a SOAR platform to respond to detected security threats. Most NDR solutions can only listen and monitor network traffic without a built-in capability to respond.

Threat hunting

Threat hunting is an iterative process to proactively search for and identify weaknesses in the system or endpoint behavior. The approach combines digital forensics with incident response tactics to identify possible entry points for an attacker or uncover previously unknown cyber threats inside the organization. Threat hunters assume that the threat actor is already inside, and they focus on finding unusual behavior prior to malicious activities. The primary goal for a threat hunter is to identify a possible attack vector and mitigate it before the attacker discovers it.

FAQ