# What Is NDR? Detecting Lateral Movement and Anomalies With Network Detection and Response **URL:** https://securesys.com.tr/en/learning/network-security/what-is-ndr-network-detection-and-response ![What Is NDR? Detecting Lateral Movement and Anomalies With Network Detection and Response](/images/bilgi-merkezi/covers/cover-network-09.webp) After an attacker enters the corporate network they do not always produce a malware alarm. They do not always use a known exploit signature. They do not always run a process that will be caught directly by the EDR. Sometimes the attacker uses existing user credentials. They take advantage of legitimate protocols. They establish network connections that look normal. And they move slowly inside the internal network. In this case the classical security controls face an important question: #### How is an attacker who has no signature but behaves abnormally inside the network detected? One of the important security technologies developed to answer this need is: #### NDR - Network Detection and Response this approach. NDR systems, by analyzing network traffic and network telemetry data; abnormal behaviour, lateral movement, Command and Control, beaconing, unusual DNS activity, data exfiltration, network reconnaissance try to detect behaviours such as these. The fundamental difference of NDR is that it does not only ask: **"Does this packet match a known attack signature?"** this question; at the same time: **"Is this network behaviour normal?"** it seeks an answer to this question. For this reason NDR is becoming increasingly critical in modern Network Security, Threat Detection, SOC and Zero Trust architectures. ### What Is NDR? NDR: #### Network Detection and Response is the security technology aimed at detecting suspicious behaviour and supporting the incident response process by analyzing network traffic and telemetry data. ### What Does NDR Do? NDR can generally provide the following functions: Network Visibility Behavioral Analytics Anomaly Detection Threat Detection Threat Investigation Response Integration ### What Is the Fundamental Aim of NDR? It is to detect activities that deviate from normal behaviour on the network. ### Is NDR the Same as IDS/IPS? No. ### What Is the Difference Between IDS/IPS and NDR? IDS/IPS mostly performs detection through: Signature Exploit Pattern Protocol Inspection these. NDR, on the other hand, performs analysis more through: Behavior Baseline Flow Pattern Network Context these. ### A Simple Comparison IDS/IPS: **"Does this traffic resemble a known attack?"** NDR: **"Is this traffic normal for this device?"** ### Which Data Does NDR Use? NDR can make use of different network telemetry sources. For example: NetFlow IPFIX sFlow PCAP DNS Logs Firewall Logs ### Does NDR Use Full Packet Capture? Some platforms can use it. ### What Is Metadata-Based NDR? It is the NDR approach that performs behaviour analysis through flow and protocol metadata instead of raw packets. ### What Is Packet-Based NDR? It is the NDR approach that uses packet-level visibility and deep packet analysis. ### What Is Hybrid NDR? It is the approach that uses flow metadata and packet data together. ### What Is Network Behavioral Analytics? It is the analysis of network communication patterns in terms of behaviour. ### What Does Behavioral Analytics Examine? Source Destination Protocol Frequency Duration Volume Timing it can analyze characteristics such as these. ### What Is a Network Baseline? It is the normal communication model for a particular user, device or system. ### How Is a Baseline Formed? The system observes the network traffic for a certain period. For example: Server A normally: Application Server B Database Server C DNS Server may be communicating with these. ### What Does Going Outside the Baseline Mean? If Server A suddenly: starts establishing SMB connections to 100 different endpoints an anomaly can occur. ### What Is Anomaly Detection? It is the detection of meaningful deviations from normal behaviour. ### Is an Anomaly Always an Attack? No. ### Can a Business Change Produce an Anomaly? Yes. A new application deployment or a backup job can look abnormal. ### Can NDR Produce False Positives? Yes. For this reason context and tuning are important. ### Why Is Behavioral Detection Important? The attacker may not use a known malware signature. However, they have to do something on the network. ### What Does the Attacker Have to Do on the Network? Discovery Authentication Communication Lateral Movement Command and Control they can carry out activities such as these. ### What Is Lateral Movement? It is the process of progressing from the first compromised system to other internal systems. ### Why Is Lateral Movement Critical? A single endpoint compromise can turn into a compromise of the whole network. ### How Does NDR Detect Lateral Movement? By analyzing unexpected internal communication patterns. ### An Example Lateral Movement Scenario A user laptop normally: DNS Proxy File Server talks with these. Suddenly: Domain Controller Database Server Backup Server it starts establishing connections with these. This behaviour can be abnormal. ### What Is East-West Traffic? It is the network traffic between internal systems. ### Why Is East-West Visibility Critical for NDR? Lateral movement mostly takes place on East-West traffic. ### Why Is Perimeter Security Not Enough? After the attacker enters the internal network the perimeter firewall may not come into play again. ### What Is East-West Monitoring? It is the monitoring of internal VLAN, server and workload communication. ### Does an Internal Segmentation Firewall Take the Place of NDR? No. The firewall provides control. NDR provides behaviour detection. ### What Is Reconnaissance? It is the attacker trying to get to know the network and the systems. ### What Is Internal Reconnaissance? It is information being gathered about internal systems after a compromise. ### Can NDR Detect a Network Scan? Yes. ### What Is a Horizontal Scan? It is one source scanning a large number of hosts over the same port. ### What Is a Vertical Scan? It is one source scanning many ports on a single host. ### What Is a Slow Scan? It is a scan carried out over a long period in order to escape detection. ### Does NDR Have an Advantage in Slow Scan Detection? Thanks to long-term behavioural analysis it can help. ### What Is Service Discovery? It is the determination of which services are running on the network. ### Can NDR See Service Discovery Activity? It can detect certain behaviours through the flow pattern. ### What Is SMB Lateral Movement? It is movement to internal systems over the SMB protocol. ### Why Is SMB Important? In Windows environments it is widespread for file sharing and administrative communication. ### What Is RDP Lateral Movement? It is passing to other systems using the Remote Desktop Protocol. ### What Is SSH Lateral Movement? It is reaching other Linux/Unix systems using SSH credentials. ### What Is WinRM? Windows Remote Management is a remote administration protocol. ### Can NDR Monitor WinRM Traffic? If there is network visibility, yes. ### Why Is Remote Service Usage Valuable for Detection? Normal user devices using an admin protocol can be an anomaly. ### Why Is Domain Controller Traffic Critical? It is the central authentication infrastructure of the Active Directory environment. ### Is Traffic From a User Endpoint to the Domain Controller Not Normal? Some traffic is normal. However, an unusual port, volume or pattern can be suspicious. ### Why Is Network Behavioral Context Important? The same connection can be normal for a server and abnormal for a user laptop. ### What Is Peer Group Analysis? It is the comparison of the behaviours of similar devices with one another. ### An Example 500 employee laptops: have the same normal communication model. If one device behaves differently the anomaly score rises. ### What Is Entity Behavior Analytics? It is the analysis of the behaviour patterns of user or device entities. ### Is There a Relationship Between UEBA and NDR? Yes. While NDR provides network behaviour, UEBA can add context with user/entity behaviour. ### What Is Beaconing? It is the compromised endpoint establishing a connection to the attacker infrastructure at certain intervals. ### Why Is Beaconing Used? Malware or an implant can make a periodic check-in in order to receive commands from the C2 server. ### How Does Beaconing Look? For example: Every 60 seconds the same destination a similar data size ### How Does NDR Detect Beaconing? Timing pattern, destination, packet size, connection interval by analyzing characteristics such as these. ### What Is Jitter? It is the beacon intervals being changed by small amounts in order to escape detection. ### Does Jitter Make Beaconing Detection Difficult? Yes. ### Can Behavioral Analytics Catch Jitter? Advanced time-series analysis can help. ### What Is C2? C2: #### Command and Control is the control communication between the attacker and the compromised system. ### Which Protocols Can C2 Traffic Use? HTTPS DNS ICMP or other legitimate protocols can be used. ### Why Is HTTPS C2 Difficult? The traffic can be encrypted. ### Can NDR Analyze Encrypted Traffic? Without the payload it can perform metadata and behaviour analysis. ### What Is Encrypted Traffic Analysis? It is security insight being derived from the metadata characteristics of TLS encrypted traffic. ### What Can TLS Metadata Contain? Destination Certificate Information Session Duration Connection Frequency ### What Is JA3? It is the fingerprint approach used for TLS client behaviour fingerprinting. ### Is JA3 Reliable on Its Own? No. It must be used with additional context. ### What Is TLS Fingerprinting? It is deriving a client or application profile from the characteristics of the TLS handshake. ### Why Is Encrypted Traffic Visibility Important? A large part of modern network traffic is encrypted. ### Can NDR Work Without TLS Inspection? Yes. Metadata-based detection can be performed. ### Does TLS Decryption Provide More Visibility? Yes. However, privacy and performance must be evaluated. ### Why Is DNS Important for NDR? DNS is used before most external communication. ### What Is DNS Anomaly Detection? It is the detection of query patterns different from normal DNS behaviour. ### What Is DNS Beaconing? It is periodic DNS queries being used for C2 purposes. ### What Is DNS Tunneling? It is data being carried over DNS queries or responses. ### What Are the Signs of DNS Tunneling? Long Subdomain High Query Frequency High Entropy Unusual Record Types ### What Is Subdomain Entropy? It is the randomness level of the subdomain characters. ### What Is DGA? DGA: #### Domain Generation Algorithm is the algorithm used by malware to produce a large number of domains. ### Can NDR Perform DGA Detection? It can help with DNS behaviour and domain pattern analysis. ### What Is NXDOMAIN? It is the response that expresses that the domain could not be found as a result of a DNS query. ### Is a High NXDOMAIN Rate Suspicious? It can be an indicator of DGA behaviour. ### What Is a Newly Registered Domain? It is a domain registered recently. ### Are Connections to New Domains Risky? Not always. However, it can be evaluated as threat context. ### How Is Threat Intelligence Used With NDR? The destination IP or domain can be enriched with threat intelligence. ### What Is an IOC? IOC: #### Indicator of Compromise is an indicator of a potential compromise. ### What Is IOC-Based NDR Detection? Known malicious: IP Domain URL it is the matching of traffic with indicators such as these. ### Does NDR Use Only IOCs? No. Its real strength is behavioural analysis. ### Why Can IOCs Be Insufficient? Attacker infrastructure can change rapidly. ### What Is TTP? TTP: #### Tactics, Techniques and Procedures are the behaviour methods of the attacker. ### Can NDR Perform TTP Detection? Through certain network behaviours, yes. ### What Is MITRE ATT&CK? It is the knowledge framework used for adversary tactics and techniques. ### Can NDR Be Mapped to MITRE ATT&CK? Yes. Detections can be mapped to ATT&CK techniques. ### In Which MITRE Tactics Does NDR Provide Value? Discovery Lateral Movement Command and Control Exfiltration ### Why Is Network Discovery Important in MITRE ATT&CK? The attacker tries to understand the internal environment. ### What Is Lateral Movement Detection Coverage? It shows to what extent NDR can detect internal movement behaviours. ### What Is Command and Control Detection Coverage? It is the capability to detect external attacker communication. ### What Is Data Exfiltration? It is sensitive data being taken out in an unauthorized way. ### Can NDR Detect Data Exfiltration? It can help through behaviour and traffic volume. ### What Is Large Data Transfer Detection? It is the detection of outbound transfer activity above the normal. ### Is a Large Outbound Transfer Always Risky? No. It can be backup or legitimate business traffic. ### Why Is the Baseline Important Here? If the normal volume is known the anomaly is evaluated more accurately. ### What Is Low-and-Slow Exfiltration? It is data being taken out in small pieces over a long time. ### Can NDR Detect Low-and-Slow Exfiltration? Long-term behavioural analytics can provide an advantage. ### What Is Cloud Storage Exfiltration? It is data being transferred to cloud storage platforms in an unauthorized way. ### Why Is HTTPS Exfiltration Difficult? The traffic can look like a legitimate cloud service. ### Can NDR Use Application Context? Depending on the platform capability, yes. ### What Is Application Protocol Identification? It is the determination of the application or protocol the traffic uses. ### What Is a Network Risk Score? It is the relative risk value calculated for a network entity or alert. ### What Can Risk Scoring Use? Anomaly Severity Asset Criticality Threat Intelligence Behavior Frequency ### What Is Asset Criticality? It is the level of importance of a system in business terms. ### Are a Domain Controller and a Printer at the Same Risk? No. ### Why Is Context-Aware Risk Scoring Important? Even a medium anomaly on a high-value asset can be critical. ### Example Medium Anomaly Domain Controller Known Malicious Destination = Critical Incident ### What Is an NDR Alert? It is the security detection produced as a result of network behaviour. ### Is an NDR Alert an Incident on Its Own? Not always. ### What Is Alert Triage? It is the first analysis of whether the alert is a real threat. ### What Does NDR Alert Triage Examine? Source Destination User Asset Timeline Related Connections ### What Is a Network Storyline? It is the display of the network events related to an incident as a sequence. ### What Is an Attack Timeline? It is the chronological ordering of the attacker activities. ### Why Is an NDR Timeline Valuable? The analyst can answer the following questions: When did the first connection happen? Which systems were affected? Where did the attacker move? ### What Is Root Cause? It is the starting reason of the incident. ### Can NDR Always Find the Root Cause? No. Endpoint or identity telemetry may be needed. ### Why Are NDR + EDR Strong? NDR sees network behaviour. EDR sees endpoint behaviour. ### An Example NDR: Suspicious SMB Lateral Movement EDR: PowerShell Execution Together: they provide stronger incident context. ### What Is XDR? XDR: #### Extended Detection and Response is the detection model that analyzes endpoint, network, identity and other telemetry sources together. ### Can NDR Be a Part of XDR? Yes. ### What Is the Difference Between NDR and the SIEM? NDR provides network-specific analytics. The SIEM correlates different log sources centrally. ### Should NDR Send Events to the SIEM? Yes. ### How Do NDR and the SOC Work Together? The SOC uses NDR alerts in the: triage, investigation, incident response processes. ### What Are the NDR SOC Use Cases? Lateral Movement C2 Beaconing DNS Anomaly Data Exfiltration Network Scan ### What Is NDR and SOAR Integration? It is an automated response being started after an NDR detection. ### What Is Automated Response? It is a particular security action being applied automatically after a threat detection. ### What Kind of Response Can NDR Trigger? Firewall Block NAC Quarantine EDR Isolation Ticket Creation ### An NDR + NAC Example NDR: Compromised Endpoint Alert ↓ SOAR ↓ NAC ↓ Quarantine VLAN ### An NDR + Firewall Example NDR: Malicious C2 Detected ↓ Firewall ↓ Destination Block ### An NDR + EDR Example NDR: Lateral Movement ↓ EDR ↓ Endpoint Network Isolation ### Is Automated Response Risky? Yes. A false positive can create a production impact. ### What Is Human-in-the-Loop? It is analyst approval being required before an automated response. ### What Is Semi-Automated Response? The detection is automatic, the final containment is analyst approved. ### Where Should Full Automation Be Used? It can be evaluated on a risk basis for high-confidence detections. ### What Is a Confidence Score? It is the level of confidence that the detection is a real threat. ### Are Detection Confidence and Severity the Same? No. Severity: impact Confidence: probability of correctness they are related to these. ### What Is NDR Threat Hunting? It is the proactive searching for threat behaviour on network telemetry. ### Does Threat Hunting Require an Alarm? No. ### What Is Hypothesis-Driven Hunting? It is investigation being carried out through a particular attack hypothesis. ### An Example Threat Hunt Hypothesis: "Compromised devices may be making periodic external beacons." Analysis: Periodic outbound connections are searched for. ### What Can a Network Hunt Query Use? Source Destination Port Frequency Duration Bytes ### What Is Historical Search? It is investigation being carried out on past telemetry. ### What Is Retrospective Detection? It is historical data being analyzed again when a new IOC or detection logic emerges. ### Why Is Retrospective Search Valuable? A malicious IP learned today may have been used in the past. ### What Are First Seen and Last Seen? They show the time the threat activity was first and last seen. ### What Is NDR Forensic Investigation? It is the use of network telemetry for incident analysis. ### Why Is PCAP Useful in an NDR Investigation? The raw traffic details can be reached. ### What Is NDR Packet Replay? It is captured traffic being analyzed again later. ### Can Historical PCAP Always Be Stored? Because of the storage cost it is generally limited. ### What Is an NDR Retention Strategy? It is flow and packet data being stored for different periods. ### An Example Retention Model Flow: Long term PCAP: Short term ### What Is an NDR Sensor? It is the component that observes network traffic. ### Where Is an NDR Sensor Positioned? Internet Edge Data Center Core Network Critical Segment ### Why Is Sensor Placement Critical? It cannot analyze traffic it does not see. ### What Is an NDR East-West Sensor? It is the sensor positioned in order to observe internal communication. ### Is a Network TAP Used for NDR? Yes. ### Is SPAN Used for NDR? Yes. ### What Is a Virtual TAP? It is the mechanism that provides a traffic copy in a virtual/cloud environment. ### What Is Cloud NDR? It is the NDR approach that analyzes cloud workload and network traffic. ### Are VPC Flow Logs Used for NDR? Yes. ### What Are VNet Flow Logs? They are cloud network flow telemetry. ### Why Is Cloud East-West Traffic Important? It is critical for workload-to-workload lateral movement. ### What Is Hybrid Cloud NDR? It is on-premise and cloud network telemetry being analyzed together. ### What Is Multi-Cloud NDR? It is the combined analysis of the network visibility on more than one cloud provider. ### What Is Kubernetes NDR? It is the monitoring of network behaviour in container and Kubernetes environments. ### What Is Pod-to-Pod Traffic? It is the communication between Kubernetes workloads. ### Is Pod-to-Pod Lateral Movement Possible? If there is incorrect segmentation, yes. ### Does Micro-Segmentation Take the Place of NDR? No. ### Why Are Micro-Segmentation + NDR Strong? Segmentation limits the movement. NDR detects the movement attempts. ### What Is the Relationship Between Zero Trust and NDR? Zero Trust is not only access control. It requires continuous monitoring as well. ### Can Continuous Verification Be Supported With NDR? Network behaviour can be used as a risk signal. ### Can a Device Risk Score Affect the Access Policy? If there is integration, yes. ### What Is Adaptive Access? It is the access policy being changed dynamically as the risk changes. ### An NDR + Zero Trust Scenario The user is authenticated. The device is compliant. Access was granted. Later NDR: Unusual Lateral Movement detected this. ↓ The risk rose. ↓ The access was narrowed. ### Does NDR Use Machine Learning? Many modern NDR platforms can use it. ### Why Is Machine Learning Used? In order to identify patterns and anomalies in high-volume network behaviour data. ### What Is Supervised Learning? It is the model training approach through labelled data. ### What Is Unsupervised Learning? It is pattern and cluster analysis being performed without prior labels. ### Why Can Unsupervised Learning Be Used for NDR? It can help to discover unknown behaviours. ### Does Machine Learning Detect Zero-Day? It gives no definite guarantee. However, it can help to identify unknown anomalies. ### Is AI Used in NDR? Yes. It can be used in behaviour analysis, alert prioritization and investigation support. ### Is AI Detection Always Correct? No. Analyst validation is needed. ### What Is Explainable Detection? It is the system being able to explain in an understandable way why it produced the alert. ### Why Is Explainability Important? It allows the SOC analyst to perform reliable triage. ### Why Is Black Box Detection a Problem? It may not be understood on which evidence the detection was formed. ### What Is NDR Tuning? It is the optimization of the detection models and policies according to the organization. ### What Is the NDR Baseline Learning Period? It varies according to the environment and the platform. ### What Is the Learning Period? It is the period in which the system collects data in order to understand the normal network behaviour. ### Are Alerts Produced in Learning Mode? It varies according to the product architecture. ### What Is a Dynamic Baseline? It is the baseline being updated as the network behaviour changes. ### What Is Baseline Poisoning? It is the risk of malicious behaviour being seen as normal for a long time and being included in the baseline. ### How Is This Risk Reduced? Threat intelligence, rules and analyst validation can be used together. ### Why Do NDR False Positives Occur? A new application backup traffic maintenance a network migration legitimate activities such as these can create anomalies. ### Why Is Change Management Important for NDR? The distinction between a planned change and a malicious anomaly becomes easier. ### Can NDR Use an Allowlist? Yes. However, it must be used carefully. ### Why Is Excessive Allowlisting Risky? It can create a blind spot. ### What Is NDR Exception Management? It is certain detections being placed under suppression or exclusion in a controlled way. ### Should Exceptions Have an Expiration Date? As far as possible, yes. ### What Is NDR Detection Engineering? It is the development and optimization of network detection logic. ### What Is Custom Detection? It is the creation of network behaviour rules specific to the organization. ### An Example Custom Detection User VLAN → Backup Server SMB Access Normally: No Detection: High Severity ### What Is an NDR Use Case Library? They are predefined network threat detection scenarios. ### Critical NDR Use Cases Lateral Movement Beaconing C2 Data Exfiltration DNS Tunneling ### What Is an NDR Coverage Assessment? It is the evaluation of whether the existing sensors and telemetry can see the critical attack scenarios. ### What Is a Detection Coverage Map? It is the matching of threat techniques with the existing detections. ### What Is a MITRE ATT&CK Coverage Map? It is the visualization of the detections according to ATT&CK techniques. ### What Is NDR Health Monitoring? It is the monitoring of whether the sensor and analytics platform is working healthily. ### Why Is NDR Sensor Packet Loss Risky? Missing traffic creates a detection gap. ### Should Sensor Packet Drop Be Monitored? Yes. ### What Is an NDR Collector? It is the component that collects the network telemetry centrally. ### What Is Collector Capacity Planning? It is the sizing of the infrastructure according to the network traffic and telemetry volume. ### What Is NDR Throughput? It is the network traffic capacity the NDR platform can analyze. ### What Is NDR Flows Per Second? It is the number of flows that can be analyzed per second. ### What Is NDR Storage Planning? It is storage sizing for flow, metadata and PCAP retention. ### What Is NDR High Availability? It is the architecture that provides the continuity of the analytics and sensor infrastructure in the event of a failure. ### What Is NDR Security Hardening? It is the NDR platform itself being configured securely. ### Is the NDR Platform a High-Value Asset? Yes. It contains critical visibility about the network. ### Should the NDR Admin Use MFA? Yes. ### Should Role-Based Access Control Be Used in NDR? Yes. ### Should There Be a Read-Only Analyst Role? If possible, yes. ### What Is an NDR Audit Log? It is the record of admin and analyst actions. ### Should NDR Logs Be Sent to the SIEM? Yes. ### NDR KPIs For example: Network Visibility Coverage Detection Count True Positive Rate Mean Time to Triage ### NDR KRIs Sensor Blind Spot Packet Loss Critical Segment Without Visibility High-Risk Unresolved Alert ### What Is MTTD? MTTD: #### Mean Time to Detect is the average time that passes until the threat is detected. ### What Is MTTR? MTTR: #### Mean Time to Respond is the average time that passes until a response is given to the incident. ### Can NDR Reduce MTTD? Yes. Particularly thanks to network behaviour detection. ### What Should an NDR Dashboard Show? High-Risk Alerts Top Anomalies Lateral Movement External Connections ### What Is a Network Risk Map? It is the map on which network asset and communication risks are visualized. ### Is an NDR Dashboard Enough on Its Own? No. An operational workflow is needed. ### What Is an NDR Playbook? They are the investigation and response steps to be applied after a particular detection. ### What Can a Beaconing Playbook Contain? Destination analysis Endpoint check DNS history Threat intelligence ### What Can a Lateral Movement Playbook Contain? Source device Target systems Authentication logs EDR evidence ### What Can an Exfiltration Playbook Contain? Transferred volume Destination User Data sensitivity ### The NDR Incident Response Lifecycle Detect ↓ Validate ↓ Investigate ↓ Contain ↓ Eradicate ↓ Learn ### Why Are Lessons Learned Important for NDR? After every incident the detection logic can be improved. ### What Is a Feedback Loop? It is the analyst results being fed back into the detection model. ### Why Is Detection Feedback Important? True positive and false positive accuracy can be improved. ### The Most Frequently Made Mistakes in NDR The mistakes frequently encountered in organizations are these: - Installing NDR and not showing it East-West traffic - Monitoring only the internet edge - Not taking baseline learning seriously - Not tracking sensor packet loss - Not using DNS telemetry - Not adding asset criticality - Running NDR isolated from the SIEM and EDR - Producing too many alerts - Not performing false positive tuning - Enabling automated containment without control - Not reflecting network changes in the NDR - Keeping the retention period short - Not using historical hunting capability - Not evaluating MITRE ATT&CK coverage - Not hardening the NDR platform ### NDR Checklist - Is there East-West visibility? - Is there North-South visibility? - Is NetFlow/IPFIX active? - Is DNS telemetry available? - Is the SPAN/TAP coverage sufficient? - Is packet loss being monitored? - Is a network baseline being created? - Is lateral movement detection active? - Is there beaconing detection? - Is there C2 detection? - Is there DNS anomaly detection? - Is there data exfiltration detection? - Is asset criticality being added? - Is there threat intelligence integration? - Is NDR integrated with the SIEM? - Is there EDR integration? - Is there NAC/firewall response integration? - Can threat hunting be performed? - Is the historical search retention sufficient? - Is MITRE ATT&CK coverage being analyzed? ### NDR Maturity Model #### Level 1 - Basic Network Visibility Network traffic is visible but advanced analytics is limited. #### Level 2 - Flow-Based Detection Anomaly monitoring is performed through NetFlow/IPFIX. #### Level 3 - Behavioral NDR Network baselines and behavioural analytics are used. #### Level 4 - Integrated Detection and Response NDR is integrated with the SIEM, EDR, NAC and SOAR. #### Level 5 - Adaptive Network Defense Behavioural risk detection and automated containment are applied together. ### Frequently Asked Questions #### What is NDR? NDR means Network Detection and Response and it provides threat detection, investigation and response capability through network traffic and telemetry. #### What does Network Detection and Response do? It helps to detect suspicious network behaviours such as lateral movement, Command and Control, beaconing, DNS anomalies and data exfiltration. #### What is the difference between NDR and IDS? While IDS mostly focuses on signature-based detection, NDR uses behavioural analytics and network baselines. #### What is the difference between NDR and IPS? IPS provides inline prevention. NDR focuses on broader network behaviour analysis and investigation capability. #### What is the difference between NDR and the SIEM? NDR provides network-specific telemetry and analytics. The SIEM collects and correlates different security logs centrally. #### What is the difference between NDR and EDR? NDR monitors network behaviour, EDR monitors endpoint behaviour. #### What is Lateral Movement? It is the attacker progressing from the first system they compromised to other internal systems. #### What is Beaconing? It is the compromised endpoint establishing communication with the Command and Control server at certain intervals. #### What is C2? Command and Control is the control communication between the attacker and the compromised system. #### Can NDR analyze encrypted traffic? Yes. Even if the payload is not decrypted the metadata and traffic behaviour can be analyzed. #### Does NDR detect Zero-Day attacks? It is not guaranteed but because it uses behavioural anomalies instead of signatures it can help to detect unknown threats. #### Is NDR necessary for Zero Trust? It is not a mandatory product but it strongly supports the continuous monitoring and risk-based access model. #### Does NDR detect data exfiltration? Through the analysis of traffic volume, destination and behavioural patterns it can help to detect potential exfiltration activity. ### Conclusion: The Foundation of Modern Network Detection Is Understanding Behaviour Traditional intrusion detection focused for a long time on this question: **"Is there a known attack signature inside this traffic?"** This approach is still important. However, in modern attacks it is not sufficient on its own. Because the attacker: legitimate credentials, encrypted traffic, trusted protocols, built-in administration tools can use these. In this case the difference between a malicious packet and a legitimate packet can be very small. However, the behaviour is different. A normal employee laptop: backup server, domain controller, database server, 50 different endpoints establishing communication with these in a short time may not be normal. For this reason the fundamental strength of NDR is this: **It questions not the packet but the behaviour as well.** The modern network detection chain can be thought of in this way: #### Visibility ↓ #### Telemetry ↓ #### Baseline ↓ #### Behavioral Analytics ↓ #### Anomaly Detection ↓ #### Investigation ↓ #### Response NDR on its own does not solve all security problems. But when used together with IDS/IPS, EDR, SIEM, NAC, firewall and SOAR it can form a strong Detection and Response architecture. In particular: #### East-West Visibility is critical. Because after the attacker enters the network their goal is generally: **Discovery → Credential Access → Lateral Movement → Privilege Escalation → Exfiltration** to advance this chain. Network segmentation limits this movement. NAC controls who enters the network. IDS/IPS detects known attack patterns. NDR, on the other hand, asks this question: **"What is happening inside the network right now that is not normal?"** For this reason one of the most important principles of modern network defense is this: **If you do not know the normal behaviour you cannot reliably detect the abnormal behaviour.** The real value of NDR emerges not from the installation of the product; **Visibility + Baseline + Context + Detection + Response** it emerges from this combination.