What it means
NDR uses network observations to identify and investigate suspicious communication. Inputs may include packet captures, connection metadata, flow records, and protocol details available at the sensor. This can help with systems where endpoint agents are unavailable. Visibility depends on where sensors sit and which traffic reaches them. Encryption usually hides application contents; metadata such as destinations, timing, and volume may remain useful. NDR findings need asset and operational context, and a network anomaly is a lead rather than proof that an attacker is present.
AN ILLUSTRATIVE SCENARIO
A new destination in a water utility
A sensor observes an engineering workstation repeatedly contacting a destination that has not appeared in the baseline. The analyst checks change records and the workstation’s role before escalating. The connection could be an approved vendor update, but unexpected timing and volume warrant investigation. Because the traffic is encrypted, the analyst does not claim to know its HTTP method or the contents transferred from network metadata alone.
Put it to work
- Map important communication paths and choose sensor locations deliberately. Record network segments, remote users, or cloud traffic that the deployment cannot observe.
- Identify asset owners and expected communication patterns. Preserve time and connection identifiers so observations can be compared with endpoint or application records.
- Monitor packet loss, data collection health, and retention. Agree investigation and response procedures, especially where blocking traffic could interrupt a physical process.
How to check your work
Generate approved test traffic along a known path and find it in the expected records. Check sensor placement, direction, timestamps, and loss indicators. Document what the test establishes and which encrypted details remain unavailable.
Connect the ideas
- EDR
Telemetry and response capability on laptops and servers for process, file, and similar host activity.
- Log
A record emitted by a system that something happened, which may later be used as evidence.
- Exposure
Whether and how a vulnerability or service can actually be reached in this environment.
- TLS
A protocol that encrypts and integrity-protects an application conversation and checks a certificate for a name.