Network detection and response (NDR) is software that watches the traffic inside a company's network for signs of an attacker who has already got in. It also records the traffic, so that an attack can be studied later. The firewall guards the edge of the network. NDR watches what happens inside it.
NDR does not sit in the path of the traffic. It receives a copy. The copy comes from a network TAP or packet broker. A TAP is a small device on a network cable that copies every packet without slowing the traffic down. A packet is one small piece of data sent across a network. The packet broker sends each copy to the tools that need it.
From the copy, NDR learns what is normal. It learns which servers connect to which, at what times, and how much data they send. Then it raises an alert when something breaks the pattern. Most traffic today is encrypted, so NDR often cannot read the contents. But it can still see who connects to whom, when, and how much data is sent. That is often enough to spot an attacker.
Here is a typical case at a hospital group in Visakhapatnam. At 2 a.m., a server in the radiology department starts connecting to 40 other servers, one after another, on port 445, the port used for Windows file sharing. It has never done this before. Attackers do this to look around a network after they get in. The same server has also been connecting to one address abroad every 60 seconds, sending a few bytes each time. Regular small connections like these are called beaconing. Harmful software uses them to ask its controller for instructions. NDR raises one alert with both findings, and sends it to the SIEM.
The analysts then decide what to do. SOAR can cut the server off from the network. NDR also helps afterwards. Some NDR products record every packet, which is called full packet capture. Investigators doing digital forensics can replay the recording and see exactly which data left the hospital.
How is NDR different from endpoint detection and response (EDR)? EDR is software installed on each laptop and server. NDR needs nothing installed on the devices. So it also sees devices that cannot run EDR, such as printers, cameras and medical machines. Many companies use both.
One Indian maker of NDR began in lawful interception: systems that let government agencies, with legal permission, tap communications. Both kinds of product read network traffic at very high speed, so they need similar engineering.