What Is NDR? Network Detection and Response Explained

Defining Network Detection and Response

Network detection and response (NDR) is a category of cybersecurity technology that monitors traffic in real time to detect threats, anomalous behaviour, and policy violations, and provides tools to investigate and respond to those threats directly from the network layer.

Unlike traditional tools that rely primarily on signature matching, modern NDR platforms use a combination of behavioural analytics, machine learning, and threat intelligence to identify both known and unknown threats in transit. This makes NDR particularly effective against sophisticated adversaries who use custom tooling, living-off-the-land techniques, and encrypted communications to evade signature-based defences.

How NDR Works

At its core, an NDR platform performs four continuous functions:

1. Traffic Capture and Metadata Extraction

NDR sensors are deployed at strategic points, typically at the perimeter, between segments, and in cloud environments. These sensors capture raw traffic or, more commonly, extract rich metadata from flows including:

• Source and destination IP addresses and ports
• Protocol information (HTTP, DNS, SMB, TLS, etc.)
• Session duration, byte counts, and packet counts
• TLS certificate details and JA3/JA3S fingerprints (JA3 is "a method for creating SSL/TLS client fingerprints that should be easy to produce on any platform and can be easily shared for threat intelligence"; JA3S fingerprints how servers respond)
• DNS query and response records
• HTTP headers, URIs, and method types

This metadata provides a complete view of all communications without the storage overhead of full packet capture, although many NDR platforms offer selective full-capture capabilities for forensic investigation.

2. Behavioural Baselining

The NDR platform continuously analyses traffic patterns to build behavioural baselines for every device, user, and application. These baselines capture what constitutes normal communication patterns: which devices talk to which servers, at what times, using which protocols, and transferring what data volumes.

Baselines are dynamic and adapt over time to account for legitimate changes in behaviour, such as new applications being deployed or seasonal variations in traffic volume.

3. Threat Detection

With baselines established, the NDR platform applies multiple detection techniques in parallel:

• Signature matching: Identifying known threats using traditional indicators of compromise (IOCs) such as malicious IP addresses, domains, file hashes, and signatures.
• Behavioural anomaly detection: Flagging deviations from established baselines that may indicate compromise, such as a workstation suddenly communicating with an unusual external IP, a server initiating outbound connections it has never made before, or data transfers that exceed normal volumes.
• Machine-learning models: Applying supervised and unsupervised models trained on labelled attack data and normal traffic patterns to classify network behaviour with high accuracy.
• Protocol analysis: Detecting misuse of legitimate protocols, for example, DNS tunnelling, HTTP-based command-and-control channels, or unusual SMB lateral movement patterns. MITRE ATT&CK documents both: under T1071.004, "adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic", and under T1021.002, "adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB)".

4. Investigation and Response

When a threat is detected, the NDR platform provides analysts with the contextual information they need to triage and investigate:

• Timeline reconstruction: A chronological view of all activity involving the affected hosts, enabling analysts to trace the full scope of an incident.
• Packet-level forensics: The ability to drill down into raw packet data for specific sessions of interest.
• Automated response: Integration with firewalls, NAC solutions, and endpoint tools to automatically isolate compromised hosts or block malicious traffic.

Key NDR Capabilities

When evaluating NDR platforms, security teams should look for the following capabilities:

• Encrypted traffic analysis: With most traffic now encrypted, NDR platforms must be able to detect threats without decrypting traffic. Techniques such as JA3/JA3S fingerprinting, certificate analysis, and behavioural analysis of encrypted sessions are essential.
• East-west traffic monitoring: Many NDR deployments focus on north-south (perimeter) traffic, but lateral movement between internal hosts is a hallmark of advanced attacks. Effective NDR must monitor east-west traffic as well.
• Cloud and hybrid visibility: As workloads move to cloud environments, NDR must extend its visibility to virtual networks, container environments, and cloud-native services.
• High-fidelity alerting: The value of an NDR platform is directly proportional to the accuracy of its alerts. Platforms that generate excessive false positives quickly lose analyst trust and become shelfware.
• Threat intelligence integration: The ability to ingest and correlate external threat intelligence feeds with internal network telemetry improves detection coverage and provides valuable context during investigations.

NDR vs IDS/IPS: What Is the Difference?

Intrusion detection systems (IDS) and intrusion prevention systems (IPS) were the predecessors of modern NDR. NIST's SP 800-94, Guide to Intrusion Detection and Prevention Systems, published in 2007, still describes the four classic classes: network-based, wireless, network behaviour analysis and host-based. While IDS/IPS and NDR share the goal of identifying threats in traffic, there are fundamental differences:

Detection Approach

• IDS/IPS: Primarily rely on signature-based detection: matching traffic against a database of known attack patterns. While effective against known threats, this approach struggles with zero-day exploits, custom malware, and living-off-the-land techniques.
• NDR: Combines signatures with behavioural analytics and machine learning, enabling detection of both known and unknown threats.

Scope of Visibility

• IDS/IPS: Typically deployed at the perimeter and focused on north-south traffic.
• NDR: Designed for full visibility across the entire estate, including east-west traffic, cloud environments, and remote endpoints.

Response Capabilities

• IDS: Detection only: alerts are generated but no automated action is taken.
• IPS: Can block traffic inline but operates on simple allow/deny rules based on signatures.
• NDR: Provides rich investigation tools, automated response playbooks, and integration with broader security orchestration platforms.

Context and Investigation

• IDS/IPS: Alerts typically contain limited context: the matched signature, source/destination, and timestamp.
• NDR: Alerts are enriched with behavioural context, historical baselines, related events, and forensic data that dramatically accelerate investigation.

Where SenseOn Fits

SenseOn takes the principles of NDR and extends them by combining network telemetry with endpoint and identity data in a single unified platform. Traditional NDR tools operate in isolation at the network layer, requiring analysts to manually correlate their alerts with endpoint and identity context from separate tools.

SenseOn's approach eliminates this correlation gap. Its lightweight endpoint agent captures network flow metadata at the source, the endpoint itself, which means visibility extends to remote workers, cloud workloads, and encrypted sessions without requiring dedicated taps or decryption infrastructure.

When the platform detects suspicious traffic, it can immediately correlate that activity with the responsible process, user account, and broader endpoint context. This unified view allows analysts to move from alert to root cause in a fraction of the time required by traditional NDR-only approaches.

When to Invest in NDR

NDR is particularly valuable in the following scenarios:

• You lack visibility into lateral movement: If your current security stack focuses on perimeter defences and endpoint protection, NDR fills the critical gap of east-west monitoring.
• Encrypted traffic is a blind spot: If you cannot inspect encrypted traffic without deploying TLS-interception proxies (which introduce their own operational and privacy challenges), NDR's encrypted-traffic analysis capabilities are essential.
• You need to detect living-off-the-land attacks: Adversaries increasingly use legitimate tools and protocols to evade endpoint-based detection. Behavioural analytics on traffic can detect these techniques where endpoint tools may not.
• Your investigation workflow is fragmented: If analysts must pivot between multiple consoles to investigate an alert, NDR (especially when unified with endpoint and identity telemetry, as SenseOn provides) can consolidate and accelerate the investigation process.

Network detection and response has evolved from a niche technology into a foundational component of modern security operations. As networks grow more complex and adversaries grow more sophisticated, the ability to detect and respond to threats at the network layer is no longer optional; it is essential.

Sources

• NIST, SP 800-94, Guide to Intrusion Detection and Prevention Systems (IDPS), February 2007, accessed 20 September 2026
• MITRE ATT&CK, T1071.004 Application Layer Protocol: DNS, accessed 20 September 2026
• MITRE ATT&CK, T1021.002 Remote Services: SMB/Windows Admin Shares, accessed 20 September 2026
• Salesforce, JA3 - A method for profiling SSL/TLS Clients, accessed 20 September 2026

Related reading:

• What Is EDR? Endpoint Detection and Response Explained
• How SenseOn's Cross-Domain Correlation Eliminates False Positives
• Security Tool Consolidation: Replace 5 Tools with 1 Platform

How SenseOn writes, checks and corrects its content: editorial standards.