What is NDR?

NDR sensors sit on network taps, SPAN ports, or virtual switches and collect either full packet captures or flow-level metadata, NetFlow, IPFIX, or similar, without needing to sit inline in the traffic path. From that data, the platform builds a behavioral baseline for every device, user, and application on the network: which hosts normally talk to which other hosts, over which ports and protocols, at what volume, and at what time of day. Alerts fire when traffic deviates from that baseline rather than when it matches a known-bad signature, which is what lets NDR catch novel malware and living-off-the-land techniques that never trip a signature-based IDS.

Because encrypted traffic hides packet contents, NDR platforms lean heavily on metadata analysis for TLS sessions: certificate details, JA3/JA3S fingerprints of the TLS handshake, connection timing and volume, and destination reputation. A host beaconing to a rare external domain every sixty seconds with a small, consistent payload size looks like command-and-control traffic in flow metadata even without decrypting a single packet.

The gap NDR fills is east-west visibility. Firewalls are built to control north-south traffic crossing the network perimeter; once an attacker is inside, lateral movement between internal servers over SMB, WMI, or RDP often never crosses a firewall boundary at all. NDR sensors deployed on internal network segments catch that movement by behavioral deviation, flagging a workstation suddenly making SMB connections to a dozen servers it has never talked to before, for example.

Leading vendors include Darktrace, Vectra AI, ExtraHop, and Cisco Stealthwatch. NDR typically feeds its detections into a SIEM or XDR platform to add network-layer context to endpoint and log-based alerts, and the combination of NDR, EDR, and SIEM is what most mature SOCs consider baseline coverage across the major attack surfaces.