What is NDR?

NDR platforms collect full packet captures or flow records (NetFlow, IPFIX) from network sensors and apply ML models to establish normal communication baselines for every device, user, and application. Anomalies (unexpected protocols, unusual data volumes, new internal connections, connections to rare external destinations) surface as alerts without relying on signatures. This makes NDR effective against novel malware and living-off-the-land attacks that evade endpoint detection.

NDR provides the east-west visibility gap that firewalls miss. Firewalls focus on north-south perimeter traffic. When an attacker moves laterally between internal servers using SMB or WMI, NDR detects the behavioral deviation even without a specific exploit signature. Leading vendors include Darktrace, Vectra AI, ExtraHop, and Cisco Stealthwatch.

NDR integrates with XDR and SIEM to add network context to endpoint and log-based detections. The combination of NDR + EDR + SIEM provides detection coverage across all major attack vectors.