CyberGlossary

Defense & Operations

NDR (Network Detection and Response)

Also known as: Network Detection and Response, Network Traffic Analysis, NTA

Definition

A network security technology that analyses traffic — including decrypted, metadata and flow data — using behavioral analytics and ML to detect threats and orchestrate response.

Network Detection and Response (NDR) deploys sensors at strategic network points (core, perimeter, cloud VPCs, east-west between segments) to inspect packets, flow records (NetFlow, IPFIX, Zeek logs) and decrypted traffic. NDR builds behavioral baselines of hosts, users and protocols and applies ML, signatures and threat-intelligence matching to detect command and control, lateral movement, data exfiltration and anomalous protocol use that endpoint tools may miss. Tight integration with EDR/XDR, SIEM and SOAR allows automated response such as TAP-based blocking, ACL changes and host isolation. Common vendors include Vectra AI, Darktrace, ExtraHop and Corelight.

Examples

  • Vectra AI detecting beaconing from an internal host to a low-reputation domain over HTTPS.
  • Zeek-based NDR alerting on RDP lateral movement between two desktop subnets.

Related terms