Network Detection and Response systems (NDR – Network Detection Response) allows you to probe your network and Cloud Traffic deeply to detect and respond to malicious activity.
Cyber attackers often use multiple tactics to evade security tools, but in doing so they create even more opportunities for analysts to find them. Network Detection and Response (NDR) technology captures, processes and analyzes network traffic to detect and investigate data that could indicate a cyber attack. Typical network detection and response solutions use a combination of machine learning, advanced analytics, and rule-based detection to detect suspicious activity on corporate networks.
NDR is the mainstay of threat detection and response, providing deep visibility into all the other tactics and techniques attackers use to explore your network, extend control, and harden themselves.
NDR provides visibility across all ports and protocols and digs deep into traffic to analyze connections, streams, packets and metadata in real-time, while also providing backlink analysis. Critical to minimizing resolution time for a detected threat, an integrated Endpoint Detection and Response solution can automatically respond to you.
This technology not only provides real-time analysis, but also provides automated, retrospective analysis that gives your security team greater visibility into their systems over the past 360 days and allows them to comprehensively analyze what happened during a breach. Now you can understand how a cybersecurity defense has been breached, what the threat does, and what needs to be done to prevent future breaches.
Advantages
The value of metadata is that it is easy to query, facilitates faster and deeper investigations, and is much more cost-effective than storing full PCAPs. While other Network Detection and Response solutions may collect some metadata, Secromix NDR is unique in that it goes far beyond the high-level “stream” metadata of the network and collects rich metadata from within the session. For example, in a web session, other vendors collect source and destination IP, URL, and in some cases minimal header information. In turn, NDR collects all this and more, including rich metadata from inside the web session.
