What Is NDR? Network Detection and Response Explained

Network detection and response (NDR) watches the parts of an environment that cannot run an agent, along with the traffic that keeps moving after an attacker blinds the agents that can. How much that is worth depends on where your workloads live. A sensor on a data center core switch sees a lot. A sensor at a company that runs on AWS, Okta, and dozens of SaaS apps sees far less, and every mirrored byte it does see costs more.

TL;DR:

• NDR is a category of detection tools that apply behavioral analytics, and in most products signatures, to packets and traffic metadata. Response usually means telling a firewall or EDR to act.
• Its strongest case is coverage EDR cannot reach: edge appliances, hypervisors, IoT and OT devices, unmanaged hosts, and endpoints whose agents an attacker has disabled.
• Encryption has narrowed NDR's view without closing it. Handshake details are increasingly hidden, but fingerprints, timing, and flow shape still carry signal.
• Packet-based NDR gets thinner and costlier in cloud and SaaS environments. Cloud mirroring has hard limits, and identity and SaaS-to-SaaS attacks often never cross a wire a sensor can see, so check which non-packet sources a platform actually covers.

What NDR Means and Where the Term Came From

Gartner defines NDR as products that "detect abnormal network behaviors by applying behavioral analytics to network traffic data." Per Gartner's category definition, they watch traffic both inside the network (east-west) and between it and the internet (north-south). They also include automated responses such as host containment or traffic blocking.

The category started under another name. Gartner called it network traffic analysis (NTA) until a 2020 rename to NDR, chosen to reflect the tools' detection and response capabilities.

Most NDR sensors sit out-of-band and watch a mirrored copy of the traffic, so even containment usually runs through other tools: a block rule for the firewall, an isolation call to the EDR, or a lockdown sent to the identity provider.

NDR also overlaps with traditional network IDS. Early NDR leaned on behavioral detection and IDS on signatures, but the line has blurred: many NDR products have added traditional signatures, and some vendors now pitch NDR as a replacement for IDS.

How NDR Works

Most NDR products share four broad stages: they acquire network telemetry, reduce it to evidence they can store, run detections, and hand alerts to whatever system investigates or responds. Products differ in their data sources and in which stages they handle natively.

1. Traffic Acquisition

On premises, sensors get traffic from a network TAP or a switch SPAN port. TAPs are the safer choice, because switches give SPAN traffic lower priority and may drop it during processing spikes. Placement decides what a sensor can see. An internet-edge sensor sees north-south traffic and nothing between servers. Packet brokers sit in the middle to deduplicate and fan traffic out to multiple tools.

In the cloud, the provider does the copying through services such as AWS Traffic Mirroring and Google Cloud Packet Mirroring. Azure's equivalent, virtual network TAP, is still in public preview.

2. Telemetry: Packets, Flows, and Protocol Metadata

Full packet capture is the most detailed evidence of what a sensor saw, and it is enormous. A sustained 1 Gbps of uncompressed traffic fills around 11 TB of disk per day. NetFlow and IPFIX sit at the other end of the scale, with compact flow records of addresses, ports, protocol, timing, and byte counts but no payload. Zeek-style protocol metadata falls between the two, producing compact logs that let an analyst pivot from one connection to its related protocol records.

Many commercial NDR products analyze metadata first and capture packets selectively. Corelight's Smart PCAP, for example, stores packets only for traffic that matches a rule and ties them to the Zeek logs.

3. Detection: Baselines, Machine Learning, and Signatures

Behavioral detection can flag departures from a baseline learned for each host or segment, match recognizable attacker behaviors, or combine the two. Baseline-based detections need learning time and tuning, because an anomaly is not the same thing as an attack. Vendors split on method: Darktrace's models learn each network from scratch, and Vectra centers its models on known attacker behaviors. Beaconing detection usually looks for low variance in connection intervals to a destination, with consistent bytes out.

No single method catches everything, which is why many products layer signatures over behavioral models. Beacon-timing detection shows the gap: Vectra researchers built a proof-of-concept agentic C2 that works asynchronously, with no periodic beaconing for a timing model to catch.

4. Encrypted Traffic Analytics

Encryption hides payloads, so NDR reads what the handshake and the flow still expose. Under TLS 1.3, certificates travel encrypted, and Zeek's ssl.log loses certificate details but keeps the server name, TLS version, cipher, and curve.

Client fingerprinting has had to adapt. JA3 hashes stopped being stable after Chrome began randomizing extension order in early 2023, and JA4 sorts ciphers and extensions so the fingerprint holds. Packet sizes, timing, and session shape also survive encryption.

Encrypted Client Hello removes more. RFC 9849, published as a Proposed Standard in March 2026, encrypts the inner ClientHello, including the SNI. Real-world adoption is uneven and hard to measure: on one university network in February 2025, only 1.5% of the ECH flows observed were genuine, and the rest were GREASE placeholders. Measure ECH on your own traffic before planning around it.

DNS over HTTPS hides queries from Zeek's dns.log, which pushes teams back to resolver logs. Some vendors can decrypt traffic with forwarded session keys, at the cost of extra key-handling and privacy work.

What NDR Catches That EDR Misses

EDR records what runs on a host, including process and file activity. NDR records what crosses the wire, including traffic from hosts EDR has never seen or can no longer see.

• Edge and network appliances. ADCs, VPN gateways, and firewalls sit outside EDR's reach, and vulnerabilities in this class made up about half of enterprise-related zero-days in 2025.
• Hypervisors. ESXi cannot run traditional EDR agents, which leaves a visibility gap at the virtualization layer. CISA's ESXiArgs guidance has defenders review network logging to and from ESXi hosts for unusual scanning.
• IoT and unmanaged devices. In a case S-RM documented, EDR quarantined Akira's Windows encryptor. The attackers then found an unsecured Linux webcam on the same network, deployed ransomware from it, and encrypted shares over SMB. Nothing was watching the webcam's SMB traffic, which might have flagged the burst. The pattern is common: in Microsoft's 2024 data, over 90% of attacks that reached the ransom stage used unmanaged devices for initial access or remote encryption.
• Blinded endpoints. ESET has documented almost 90 EDR killers, most of which abuse vulnerable drivers to disable security tools. A disabled agent stops reporting, but the host keeps generating network activity that a passive sensor still records.
• Lateral movement with valid credentials. RDP was used internally in 66% of the cases Sophos handled for its 2026 Active Adversary Report. Living-off-the-land activity is built to look like normal administration on each host. Across many hosts, the same lateral movement can form a pattern that a single endpoint rarely shows.

EDR still wins on process context. Endpoint telemetry establishes what ran and how. Network evidence establishes who talked to whom, over what protocol, and how much data moved, and most investigations need both.

Where NDR Struggles: Cloud, SaaS, and Remote Work

NDR was built for networks a company owns and can tap. Public cloud provides a copy of traffic only on the provider's terms.

On AWS, mirrored traffic counts toward instance bandwidth, and AWS drops mirrored packets when an instance hits its bandwidth or packets-per-second limit, because production traffic takes priority. For instances outside placement groups, mirrored packets in any flow above 2.5 Gbps are dropped. Each mirroring-enabled network interface bills at $0.015 per hour in US East (Ohio), with data transfer and load balancer charges on top.

Flow logs are the cheaper fallback, and they come with gaps. Google Cloud VPC Flow Logs sample packets at a first-stage rate that varies with host load and that customers cannot change. AWS flow logs skip traffic to the Amazon DNS server and the instance metadata service. NDR products that ingest flow logs gain agentless cloud coverage at the cost of payload depth.

Kubernetes is harder still. A sensor can see traffic between nodes, but pod-to-pod traffic on the same node never leaves the host without a forwarding component deployed in the cluster. Agentless pod-level coverage is rarely complete.

Some attacks never touch a network segment a sensor can see. OAuth consent abuse, SaaS-to-SaaS movement through API integrations, and session token theft after MFA all happen between cloud services, which is why they fall to identity threat detection. Remote users' traffic often skips office sensors entirely unless a cloud TAP copies it back to the NDR platform.

Vendors are reaching for these gaps by adding identity and cloud telemetry to network data, as Vectra does for Entra ID and Microsoft 365. Corelight cites a March 2024 Gartner prediction that by 2029 more than 50% of incidents NDR discovers will come from cloud network activity, up from about 10% at the time of the forecast.

NDR Next to EDR, SIEM, and XDR

In 2015, Anton Chuvakin coined the "SOC nuclear triad" of logs, endpoint data, and network traffic. Gartner later framed it as the SOC visibility triad of SIEM, EDR, and NDR.

XDR platforms increasingly fold in network telemetry, their own or a third-party NDR's, alongside EDR and identity data. Omdia's 2023 analysis saw the market moving toward integrated XDR, while specific use cases keep standalone NDR alive. If that trend holds, standalone NDR will need to justify itself through coverage broader platforms lack.

How to Decide Whether You Need NDR

For OT, ICS, or large IoT fleets, NDR is foundational. CISA's 2026 OT zero trust guidance relies on passive monitoring through SPAN ports or unidirectional taps, and Dragos found adequate OT network monitoring in only 46% of the assessments it ran.

Compliance requirements also matter. NERC CIP-015-1, which FERC approved in 2025, requires internal network security monitoring for high-impact BES Cyber Systems and for medium-impact systems with external routable connectivity, enforceable from October 1, 2028.

FERC approved CIP-015-2 in August 2026; it extends that monitoring to the associated access control and physical access systems in phases from 2029. Both standards require a monitoring capability, not a product labeled NDR. If you handle cardholder data, PCI DSS v4.0.1 requirement 11.5.1 already calls for intrusion detection or prevention at the CDE perimeter and at critical points inside it.

In large on-premises or hybrid data centers with flat east-west traffic, NDR can show lateral movement that perimeter controls and per-host agents miss. If most of your infrastructure is cloud and SaaS, test whether NDR adds coverage beyond your endpoint, identity, and cloud detections. Compare packet-based monitoring with the flow-log and API-based sources a platform supports, including what each costs to collect and what it misses.

Tuning takes engineering time, and it recurs: baselines drift after migrations, acquisitions, and large workforce changes. If your detection engineers have that time, an open-source stack built on Zeek, Suricata, or Security Onion is viable. If they don't, a commercial platform's support and managed updates are what you are paying for.

Most organizations will match more than one of these conditions, and a hybrid estate can justify NDR in the data center while relying on logs in the cloud.

Why Network Alerts Need Context

An NDR alert describes behavior on the wire, such as a host beaconing, an unusual SMB burst, or a TLS fingerprint the team has never seen. Whether that behavior is malicious usually depends on facts the sensor does not have. The analyst needs to know which process opened the connection and whose account authenticated, and whether a backup job or a sanctioned admin tool normally does this on Tuesdays.

Network detections close faster when organizational context about systems, owners, and normal behavior arrives with every alert. That is why integrations now pull EDR process data and identity data into network detections.

Managed services are moving the same way. Daylight's MDR service treats alerts from network detection tools such as Zeek and Suricata as one input among many and investigates them against telemetry, organizational, and historic context.

Frequently Asked Questions About NDR

Does NDR Need a SIEM?

No, but many teams send NDR alerts and metadata to one. The NDR console handles detection and packet-level investigation. The SIEM keeps longer retention and lets analysts search network records alongside identity, endpoint, and cloud logs. Zeek-style logs are structured records, and many SIEMs and data lakes ingest them without a custom parser.

Does NDR Still Work Once Encrypted Client Hello Is Widespread?

Partially. RFC 9849 notes that the destination can still leak through plaintext DNS queries or server IP addresses. On managed endpoints where you control browser policy, disabling ECH preserves SNI-based detection, though unmanaged devices stay out of reach.

How Much Storage Does NDR Need?

It depends on whether you keep packets, and the ratio varies by product, traffic mix, indexing, and compression. As a rough guide, Arkime puts session metadata at about 5% of PCAP storage for the same retention period. Size against your measured average utilization rather than link capacity, keep metadata for months, and keep full packets for days on priority segments.

What Should an NDR Proof of Concept Test?

Put sensors on segments that represent the traffic you care about, including at least one cloud or hybrid path, and measure packet loss at each SPAN or mirror point first. Then replay or emulate attacker behavior across those segments, check how much of your encrypted traffic still produces useful detections, and count false positives through the tuning period. Also ask how the vendor keeps a baseline from absorbing an attacker who is already inside during onboarding, since anything present while the model learns can end up treated as normal.