What is network detection and response (NDR)?

Network detection and response (NDR) is a cybersecurity technology that monitors network traffic to detect, investigate, and respond to threats that other tools miss. Instead of matching known signatures, it applies behavioral analytics and machine learning to the traffic itself, spotting the patterns an intrusion leaves behind. That focus on behavior lets it catch threats with no prior signature, from lateral movement inside the network to command-and-control channels hidden in encrypted traffic. Gartner formally defined the category in 2020 and published its first Magic Quadrant for NDR in 2025. NDR earns its place because attackers who slip past the endpoint and the perimeter still have to use the network, and every move they make there leaves a trace. This page covers what NDR is, how it works, the traffic it watches, how it compares to endpoint and log-based tools, and where it fits in a modern security operations center (SOC).

Key takeaways

NDR watches the network, not the endpoint. It analyzes traffic to find threats, so it sees activity that endpoint agents and logs never capture.
It relies on behavior, not signatures. Machine learning and behavioral analytics let NDR detect novel threats, including zero-day activity and encrypted command-and-control traffic.
East-west visibility is its strength. By inspecting traffic between internal systems, NDR exposes lateral movement that perimeter tools cannot see.
It is agentless. NDR reads mirrored traffic from network taps or flow logs, so it covers unmanaged, IoT, and operational technology (OT) devices that cannot run an agent.
It is one pillar of three. NDR works alongside endpoint detection and response (EDR) and a security information and event management (SIEM) system in what Gartner calls the SOC visibility triad.

How NDR works

An NDR platform ingests network traffic from sensors placed at key points across the environment, taking either full packets or flow records and metadata. It builds a baseline of what normal traffic looks like for every device, user, and segment, then watches for deviations from that baseline in real time. Because the model describes behavior rather than known-bad indicators, it flags activity that has never been seen before, not just recognized attacks.

Detection draws on a few complementary methods. Behavioral analytics and machine learning model how hosts and accounts usually communicate. Deep packet inspection and flow analysis surface the details of specific connections. Threat intelligence adds context about known malicious infrastructure. When something suspicious appears, the platform raises a prioritized alert and, depending on configuration, either guides the analyst through containment or acts directly, isolating a host or terminating a session, and it commonly hands off to a security orchestration, automation and response (SOAR) system or an EDR tool to enforce the response.

NDR grew out of older network security. Intrusion detection systems (IDS) came first, matching signatures to catch known attacks, but they generated noise and were straightforward to evade. Next-generation IDS added anomaly and behavioral checks. Modern NDR extends that lineage with AI-driven analysis that detects both known and unknown threats and is far easier to operate.

North-south and east-west traffic

NDR monitors two kinds of traffic, and the second is what sets it apart. North-south traffic crosses the perimeter, moving between the internal network and the outside world, which is where initial access attempts and data exfiltration show up. East-west traffic moves laterally between internal systems, and it is the blind spot for most perimeter-focused tools.

Lateral movement is NDR's strongest use case. Once a threat actor has a foothold and is using valid credentials, a workstation that suddenly reaches file servers it has never touched, or authentication attempts against systems outside the normal pattern, looks legitimate to perimeter defenses and can be invisible to endpoint tools when the credentials are real. On the network, that behavior stands out. These signals often precede ransomware deployment by days or weeks, which turns east-west visibility into early warning.

Detecting threats in encrypted traffic

Most traffic is now encrypted, and the majority of threats ride inside that encryption, which blunts tools that depend on reading payload contents. NDR handles this by analyzing the shape of encrypted communications rather than decrypting them. It examines connection metadata such as addresses, ports, certificate details, session duration, and data volumes. It fingerprints the client and server behind a TLS handshake, a technique known as JA3 and JA4, to spot software that does not match anything legitimate. It measures timing and entropy to catch the regular callbacks of beaconing malware. None of this requires breaking the encryption, so NDR stays effective where deep packet inspection alone falls short.

NDR vs EDR, SIEM, and XDR

NDR is often compared to the other detection technologies it sits beside. The distinction comes down to the data each one watches, and the gaps each one leaves.

Technology	What it monitors	Where NDR complements it
EDR (endpoint detection and response)	Process, file, and memory activity on managed endpoints via an installed agent.	NDR covers unmanaged, IoT, and OT devices that cannot run an agent, and sees lateral movement between hosts.
SIEM (security information and event management)	Log data collected and correlated from across the organization.	NDR reads traffic directly, so it keeps working when logs are missing, incomplete, or tampered with.
XDR (extended detection and response)	Correlated telemetry across endpoint, network, cloud, email, and identity.	NDR provides the network layer within XDR, or runs standalone for deeper traffic analysis.

The three foundational tools form what Gartner calls the SOC visibility triad: SIEM for logs, EDR for endpoints, and NDR for the network. The idea is simple. No single source sees everything, and attackers exploit the gaps between tools. Threats that operate below the level an endpoint agent can see, or that never generate a log, still have to move across the network, where NDR observes them. XDR then builds on this by correlating these sources into unified incidents, with NDR supplying the network signal.

What NDR gives a security team

The value of NDR shows up in a handful of concrete ways:

Coverage the other tools lack. Agentless monitoring reaches every device that touches the network, including the unmanaged and IoT or OT systems that endpoint tools cannot protect.
Fewer, better alerts. Because leading platforms model active attacker behavior rather than raw anomalies, they surface high-fidelity detections instead of drowning analysts in noise.
Faster investigation. NDR correlates activity across time, users, and systems, reconstructing an attack so analysts can see what a host did before and after an alert.
Support for zero trust. By continuously checking internal traffic against expected behavior, NDR helps verify that no device or session is implicitly trusted, and flags deviations from segmentation policy.

How NDR is deployed

NDR sensors usually run out of band, analyzing a copy of the traffic delivered by a network tap or a switch mirror port. This adds no latency and cannot break the network if a sensor fails, though it means the platform contains threats by integrating with a firewall, switch, or EDR rather than blocking packets itself. An inline deployment, where the sensor sits directly in the traffic path, can block malicious traffic on its own but introduces latency and a potential point of failure. Most enterprises choose out-of-band monitoring for broad coverage and add inline sensors only at critical chokepoints where immediate blocking is worth the tradeoff.

Expert insight: the network is one signal, not the whole picture

Network traffic tells you something no other source can. It is also, on its own, only part of the story. An NDR alert that a server is beaconing to unfamiliar infrastructure is valuable, but it becomes far more useful when a team can connect it to the endpoint that started the process, the identity that authenticated, and the intelligence on the infrastructure being contacted. Read in isolation, a network signal shows that something is wrong; read in context, it shows what is happening and what to do about it.

This is how Sekoia approaches network telemetry. Sekoia is a European cybersecurity vendor, and its unified AI SOC platform treats network detections as one input among several, correlated with endpoint, identity, and cloud signals and enriched by its in-house Threat Detection & Research (TDR) team's intelligence. Detections map to the MITRE ATT&CK framework, so a piece of lateral movement seen on the network connects to the wider intrusion rather than sitting as a standalone event. For teams that want network coverage without running a separate, siloed appliance, folding network signal into a broader detection platform keeps investigation in one place.

To be clear about scope, a dedicated NDR appliance from a specialist vendor will go deeper on pure packet analysis than a generalist platform, and some environments genuinely need that depth. What a unified SOC platform offers instead is correlation: the network becomes one reliable signal in a fuller account of an attack. As a European vendor with a data-sovereignty posture, Sekoia also suits organizations that need their traffic and detection data handled under European governance.