TopicCybersecurity →
Simple definition
NDR is a concept or mechanism used in cybersecurity to detect abnormal behaviors from network traffic.
Technical definition
In a business environment, NDR mainly intervenes to detect abnormal behaviors from network traffic. Its implementation depends on the architecture, equipment and security policies in place.
What’s the point?…
detect abnormal behaviors from network traffic.
Concrete example
an NDR engine reports unusual lateral communication.
Common problems
- encryption
- false positives
- network coverage
To be noted: Always adapt the diagnosis to the version of the product and to the architecture actually deployed.