Network detection and response (NDR) software is used to document business network activity for security threats and alert relevant parties or automate threat remediation. These tools work by monitoring east-west traffic and comparing them to established baselines. When traffic behavior deviates from normal functionality, the solution will detect the issue and assist in forensic investigation. Many tools include or integrate with other solutions that automate incident response processes to minimize the threat’s impact.
These tools are used by security professionals and IT staff to observe network traffic and detect anomalies related to user behavior. Other, older technologies may offer one component of network threat detection or incident response, but NDR combines the functionality of numerous security solutions. These tools use artificial intelligence and machine learning to analyze user behavior as well as existing security data; security professionals can then use that data to develop streamlined discovery and response workflows.
Network traffic analysis (NTA) is a similar emerging technology related to NDR. NTA is the core technology behind NDR; it refers to the analytical and monitoring capabilities used to develop baselines and response frameworks as NDR. But NTA solutions do not have the same level of response automation and end-user, behavioral anomaly detection used to trigger incident response. Endpoint detection and response (EDR) has a similar name, but products within that category only detect issues at the device level while NDR provides visibility to threats across the entire network.
To qualify for inclusion in the Network Detection and Response (NDR) category, a product must:
- Analyze network traffic in real time
- Utilize AI or ML to develop baselines for network behavior
- Automate threat and anomaly detection across the network
- Deploy network forensics upon detection for investigation and remediation
