Detection and response systems in IT and OT networks

Network Detection and Response (NDR) systems detect abnormal system behavior by applying behavioral analysis to network traffic data. They continuously analyze raw network packets or operational metadata between internal and public networks.

NDR technologies aim to identify and stop network threats that cannot be easily blocked using known attack patterns or signatures. NDR technology utilizes machine learning and behavioral analytics to monitor network traffic and establish a baseline of activity. The NDR solution enables the recognition of unusual traffic.

NDR tools continuously analyze raw traffic and data flow records (such as NetFlow) to create models that reflect normal network behavior. When NDR tools detect suspicious traffic patterns, they trigger an alert; an important function of the NDR solution is also the response to the situation.