Network detection and response (NDR) watches copies of network traffic, or metadata about it, to spot attackers who are already inside. It finds behavior like lateral movement, unusual internal scanning and command and control beaconing, then helps responders investigate. Encryption limits what it can read, so it leans on metadata and patterns.
What does NDR collect?
An NDR system gets traffic from sensors placed at network taps or mirror ports, from cloud traffic mirroring, or from flow records exported by switches and routers. Depending on the setup it keeps full packets for a short time, or compact summaries: who talked to whom, when, how much, over which protocol. It often parses DNS queries, TLS handshake details, and common protocols such as SMB and HTTP.
MITRE ATT&CK defines network traffic as a data source, with components such as network connection creation, traffic flow and content. That list is a useful checklist of what a network sensor can contribute to detection.
Why look at the network when you have endpoint tools?
Some devices cannot run an agent: printers, medical equipment, industrial controllers, old servers, and many IoT devices. An attacker who lands on one of them is invisible to endpoint software, but the device still has to talk across the network. Attackers can also disable endpoint tools. They cannot easily avoid generating traffic when they move.
So the network gives a second view, independent of what is installed on a host. It is strongest for the middle of an attack: scanning, lateral movement, staging data and exfiltration.
A constructed example. A badge printer in the finance wing normally talks to one print server. One evening it starts connecting to forty internal hosts on the file sharing port, then sends large outbound transfers to an address seen nowhere else. No agent runs on the printer, but the network sensor logs a clear change in behavior and raises it.
What are the limits?
Encryption. Most traffic now uses TLS, so content is not visible. NDR can still use handshake details, certificate and server name information that is visible, timing, sizes and destinations. Decrypting at inspection points is possible but raises cost, privacy and legal questions.
Placement. A sensor sees only what passes it. East-west traffic between servers in the same segment may never cross a monitored link. Cloud and remote work shift traffic away from the office network entirely.
Tuning. Networks are noisy. Backup jobs, scanners and monitoring tools look like attacks unless you label them.
Response. Detection without action is a report. Check whether the tool can trigger blocks or isolation through your firewalls and endpoint tools, and whether you want it to.
How is it different from an intrusion detection system?
A traditional intrusion detection system matches traffic against signatures of known attacks. NDR products usually add behavior analysis, retrospective search through stored metadata, and investigation workflows. The line is blurry, and vendors use the terms loosely, so ask what a product does instead of relying on the label.
What does a good investigation look like with NDR?
An analyst starts from an alert, for example a host contacting many internal systems. The tool should show the timeline of that host's connections, which protocols it used, how much data moved and whether any of the destinations are new for it. From there the analyst pivots: who else talked to the same external address, and when did it first appear?
Retrospective search is the feature to test. When a new report names an address or domain used by attackers, you want to ask whether any host contacted it during the past months. If the tool kept only a few days of data, you cannot answer. If it kept compact metadata for longer, you can, even without full packets.
Finally, check how the findings leave the tool. Alerts should flow to your ticketing or case system with enough context to act, and the evidence should be exportable, in case you need to share it with an outside responder or law enforcement.
How to check or apply this
- Draw your network and mark where traffic from critical systems actually crosses a link you could monitor.
- Decide what to keep and for how long: flows for months, packets for days, for example.
- Label known noisy systems, such as scanners and backup servers.
- Test with a safe simulation of lateral movement and see whether and how fast it alerts.
- Connect alerts to a named responder and a playbook.
- Review coverage whenever you add a cloud account or a new office.
Quick check
Can NDR inspect encrypted traffic?
Not the contents, unless you decrypt at an inspection point. It can analyze metadata such as destinations, volumes, timing and unencrypted handshake fields.
Do I need NDR if I have endpoint detection?
They cover different gaps. Endpoint tools miss devices without agents. Network analysis misses activity that never crosses a monitored link.
Sources
Last reviewed: 18 October 2026.
