A capable attacker can disable the endpoint agent, delete local logs, and operate from an unmanaged device the security team has never seen. What they can’t do is avoid the network. To move laterally, reach a domain controller, contact a command-and-control server, or exfiltrate data, traffic has to cross the wire, and traffic on the wire can’t be retroactively erased the way a log file can. NDR (Network Detection and Response) is the detection discipline built on that fact.
It’s a reference-grade category with a specific job: watch network traffic continuously, model what normal communication looks like for each host and segment, and flag the deviations that indicate compromise, then give responders the means to act on what it found.
What Is Network Detection and Response (NDR)?
NDR is a category of security technology that detects and responds to threats by analyzing network traffic, using behavioral modeling and machine learning rather than relying only on known-bad signatures. NDR platforms ingest raw packets, flow records, or traffic mirrored from strategic points in the environment, build baselines of normal communication patterns, and alert when behavior deviates in ways associated with attack activity: a workstation suddenly talking to dozens of servers it’s never contacted, beacon-like traffic to a new external domain, or data volumes moving outbound at 3 a.m.
The “response” half distinguishes NDR from its ancestors. Classic intrusion detection systems (IDS) matched packets against signature databases and generated alerts; what happened next was somebody else’s problem. NDR platforms add investigation context, session reconstruction, historical traffic search, entity timelines, and response actions such as triggering a firewall block, quarantining a device via NAC integration, or feeding a containment workflow. The category also assumes attackers will be inside the perimeter, so east-west traffic between internal systems gets the same scrutiny as north-south traffic crossing the boundary.
The distinction from endpoint tooling is complementary, not competitive. EDR sees deep process-level detail on managed hosts and nothing anywhere else. NDR sees every device that touches the network, managed or not, but can’t see inside the processes generating the traffic. Most intrusions eventually show up in both, from different angles.
The Network Layer of SOC Visibility
One Leg of the Visibility Triad
SOC architects commonly describe detection coverage as a triad: endpoint telemetry (EDR), log and event data aggregated in a SIEM, and network traffic analysis (NDR). Each leg covers the others’ blind spots. Endpoints miss unmanaged devices, IoT hardware, printers, personal machines, legacy servers where no agent can run. Logs only record what applications chose to write down, and attackers with sufficient privilege can tamper with them. The network sees everything that communicates, whether or not it’s managed, logged, or even known to the asset inventory. And that last property makes NDR the leg most likely to catch the things the other two don’t know exist.
What the Wire Catches That Endpoints Miss
Map attacker behavior against MITRE ATT&CK and a pattern appears: several tactics are inherently network-visible. Command and control requires outbound communication. Lateral movement requires host-to-host connections. Exfiltration requires data leaving. Discovery often means one host scanning or querying many others. A useful exercise for detection engineers is to walk through the ATT&CK matrix and mark, technique by technique, which telemetry source would actually catch it in their environment; the network column fills in exactly where agent coverage runs out. Rogue devices, compromised IoT, and attacker infrastructure staged on unmanaged hosts are network-first detections almost by definition.
And there’s the tamper-resistance argument. An attacker who gains admin rights on a host can stop the EDR sensor and scrub the event log. Traffic captured off a mirror port or network tap was recorded by infrastructure the compromised host can’t reach. That makes network evidence unusually durable, which investigators come to appreciate.
Where the Sensors Actually Go
NDR coverage is only as good as sensor placement, and placement is a budget exercise as much as an engineering one. Full packet capture everywhere is neither affordable nor necessary; what matters is instrumenting the chokepoints where interesting traffic must pass: the internet edge, the paths into data center and server segments, connections to identity infrastructure, and the boundaries between security zones. East-west visibility inside flat networks is the usual gap, and cloud environments add their own wrinkle, there’s no switch to mirror, so coverage comes from provider-native sources like VPC flow logs and traffic mirroring services instead of physical taps. Teams that map sensor placement against their crown-jewel assets, rather than just deploying where it’s convenient, get dramatically more detection per dollar.
Behavioral Modeling and the Encryption Question
The obvious objection: most traffic is now encrypted, so what’s left to inspect? Less than skeptics assume is lost. NDR’s detection models lean heavily on metadata that encryption doesn’t hide, connection endpoints, timing, frequency, session duration, byte counts, TLS handshake characteristics, and certificate details. Beaconing malware produces rhythmic, small, regular connections regardless of what’s inside them. Exfiltration produces asymmetric outbound volume. A JA3-style TLS fingerprint can identify a malware family from its handshake alone. Payload inspection helps where it’s available (and some deployments decrypt at inspection points), but behavioral NDR was built for a world where it usually isn’t. That said, encryption does narrow what any network tool can conclude on its own, which is one more reason NDR signal is best consumed alongside endpoint and identity evidence rather than in isolation.
Feeding Network Signal Into Agent Investigations
NDR Alerts as Raw Material, Not Verdicts
An NDR alert is rarely a conclusion. “Host A exhibited beacon-like traffic to domain B” is a lead that demands questions: what process opened those connections, who was logged in, is domain B actually malicious, has any other host contacted it? In a traditional SOC, a Tier 1 analyst chases those answers across four consoles, or, given queue pressure, doesn’t. This is precisely the investigation pattern an AI SOC automates: agents receive the network alert, pull the corresponding endpoint and identity context, check intelligence sources, and assemble the answer before a human looks at anything.
The economics matter here. Behavioral network detections are valuable but noisy; anomaly-based models flag genuinely unusual traffic that turns out to be benign (a new backup job looks a lot like exfiltration). When investigating each anomaly costs 30 human minutes, teams respond by turning detection sensitivity down and accepting blindness. When an agent investigates each one in minutes at near-zero marginal cost, sensitivity can stay high. Automated triage doesn’t just process NDR alerts faster, it changes how aggressively you can afford to tune the detector.
Correlation Across Endpoint, Identity, and Wire
Network evidence gets decisive when joined with the other telemetry legs. Beaconing plus a suspicious process on the source host plus an anomalous login an hour earlier isn’t three alerts, it’s one intrusion narrative. Platforms in the XDR category pursue this correlation at the telemetry layer; XDR agent integration describes how AI investigation agents consume those unified signals and carry the correlation through to an actual verdict. NDR’s contribution to that picture is the ground truth of what actually crossed the network, which either corroborates or contradicts what endpoints and logs claim happened.
Responding at the Network Layer
Network-layer response has one distinctive property: it works on devices you don’t manage. You can’t push an EDR isolation command to a compromised camera or an unmanaged contractor laptop, but you can block its traffic at a switch, firewall, or NAC boundary. Segment-level moves, cutting a compromised zone off from the rest of the environment while investigation proceeds, extend the same idea, and zone-based threat containment formalizes it. The standing caution is blast radius: an over-broad network block can take down business services faster than the attacker would have, so autonomous network response needs tight guardrails and clean rollback paths.
Within CognitiveSOC™, network detections enter the same multi-tier investigation pipeline as endpoint and identity alerts: Tier 1 agents triage and enrich the alert, and cases that warrant it escalate to deeper investigation tiers that correlate wire evidence with everything else known about the entities involved. Customers running this pipeline report 87% faster investigations than their prior manual process, with every step recorded in an evidence trail. Teams that want to see a network alert traced end to end can follow one at a live demo.
Frequently Asked Questions About NDR
How is NDR different from an IDS or IPS?
Detection method and scope of the job. A classic IDS/IPS matches traffic against signatures of known attacks and either alerts (IDS) or blocks inline (IPS). It’s effective against threats someone has already catalogued and largely blind to novel behavior. NDR baselines your environment’s actual traffic patterns and detects deviations, which catches unknown tooling and attacker behavior that no signature describes. NDR also carries the investigation and response workload, traffic history search, session reconstruction, entity timelines, containment integrations, that IDS never attempted. Many organizations run both: IPS as an inline filter for the known, NDR as the behavioral layer for the unknown.
Do you need NDR if you already have EDR and a SIEM?
It depends on what your environment looks like off the endpoint. If nearly every device is managed and agent coverage is genuinely near-total, EDR plus well-fed SIEM covers a lot. But few real environments look like that. Unmanaged and unmanageable devices, IoT, OT equipment, printers, lab systems, contractor hardware, are invisible to EDR by definition, and they’re popular footholds precisely because attackers know it. NDR is the layer that watches them. The honest sequencing question isn’t “is NDR useful” but “is the unmanaged surface in my environment large enough to be my next visibility investment,” and for hospitals, manufacturers, and campuses the answer is usually yes.
Does encrypted traffic defeat NDR?
It defeats payload inspection, not behavioral detection. The metadata encryption leaves exposed, who talked to whom, when, how often, how much, with what TLS characteristics, carries most of the signal behavioral models use. Beaconing, scanning, lateral movement patterns, and volume anomalies are all visible in encrypted flows. What encryption does remove is the ability to confirm content, so an NDR verdict on encrypted traffic is probabilistic and benefits from corroboration by endpoint or identity evidence. Treat “everything is TLS now” as an argument for correlating network signal with other telemetry, not for skipping the network layer.
When is NDR the wrong priority?
When there’s nobody, human or agent, to work its output. NDR generates behavioral leads that need investigation, and a two-person team already drowning in EDR alerts will just acquire a third unworked queue. Foundational gaps also outrank it: if endpoint coverage is thin or authentication logging is missing, those come first, because NDR findings are hardest to act on without corroborating context. And in heavily cloud-native environments where “the network” is mostly provider-managed fabric, flow logs plus cloud-native detection may deliver more value than appliance-style packet capture. NDR earns its keep in environments with meaningful on-premises or hybrid traffic and the investigative capacity, increasingly agent-provided, to chase what it finds.