What is NDR?
Network Detection and Response, told as a story about the person who watches the hallway.
Some rooms can't take a dog.The old printer, a guest laptop, the fridge. The dog (EDR) can't see in there.
Whatever room you want, you take the hallway.You may not see the rooms, but you can see the hallway.
NDR is the watcher in the hallway.It never enters a room. It only watches who passes.
A wrong kind of walk, and the hallway shuts.A huge bag heading for the gate at 2 a.m.? Tweet! Drop the portcullis, tell the guard room.
It can't see inside the box.A sealed box (encryption) shows only size, direction and time. So the dog takes the rooms, the watcher takes the hallway — together.
NDR = the watcher of the hallway, not the rooms. Who goes where, when, carrying how much — and shuts the hallway when it's wrong.
Network Detection and Response. No dog needed in every room, so it covers the rooms that can't take one. The price: it can't open sealed boxes.
When grown-ups say it
- Network
- The hallway. The paths between rooms, and between the castle and outside.
- Traffic
- People and bags in the hallway. Everything computers send each other.
- TAP / port mirroring
- The mirror at the end. Shows a copy of everything passing, without stopping anyone.
- Agentless
- Never enters a room. Which is why it covers rooms the dog can't.
- Lateral movement
- Room to room. Someone leaving the printer room for the vault. Best seen from the hallway.
- Exfiltration
- Walking out with a huge bag. At night, toward the gate, very big.
- Encryption
- The sealed box. Contents hidden; size, direction and time still visible.