Need indicators
This capability is usually relevant when these signals appear in the operating environment.
Invisible lateral movement.
Large network that is hard to monitor.
Need to detect behavior not visible on endpoints.
Back to solutions
Discuss your use case
What is this solution?
NDR analyzes network connections for unusual behavior that may not be evident in one endpoint alert. It collects flow or packet telemetry depending on deployment and relates source, destination, and time for investigation. Encrypted traffic may reveal metadata but not payloads, while containment depends on permissions and integrations.
Network detection and response uses network flow analysis for lateral movement visibility and relates changes in connectivity to asset and performance context.
Practical example
A server starts unusual connections to several internal destinations. An analyst reviews flow data and correlates it with other logs before deciding whether to contain it.
Technical summary and scope of use
Technical explanation
Network Flow Analysis Technology is a specialized system for monitoring and analysing network performance and detection of threats by collecting and analyzing flow data in real time.
The solution collects, deduplicates, aggregates, and analyzes flow data from multiple sources to identify performance indicators, detect anomalies, and generate security alerts.
The technology supports protocols:
- NetFlow
- IPFIX
- sFlow
It also supports data enrichment using:
- SNMP
- The geographical location
- Threat intelligence feeds
This technology helps to understand clearly what is happening within the network by analyzing the connection movement between devices, servers and applications.
Instead of dealing with large amounts of unregulated data, the technology collects and analyses information and then shows it in the form of panels, warnings and indicators that help operating teams and security quickly understand the network’s status.
It also helps to:
- Discover the causes of slow service.
- Identifying the disadvantages
- Monitoring the performance of applications
- Discover unusual activities.
- Tracking of assets and communications
A central view helps operations and security teams troubleshoot outages and investigate incidents sooner.
Scope of use
The technology is used in:
- Monitoring of networks
- Analysis of Application Performance
- Discover threats.
- Network investigations
- Monitoring of assets
- Analysis of trusts between systems
- Quality of communication and services.
The technical objective is:
- Provide operational and security visibility for network traffic
- Reduce the detection time.
- Accelerate security investigations.
- Improving performance monitoring.
- Support of Operations and Cyber Security teams
What it delivers
Core capabilities that turn the requirement into practical controls.
Network data collection and analysis
Observation and Vision
Performance monitoring
Expected value
The impact security teams and leadership can expect from the right implementation.
Faster detection of suspicious movement
Broader threat visibility
Better investigation support
Technical capabilities
Feature availability depends on product version, target systems, deployment, and integrations.
Network data collection and analysis
Network flow analysis in real time
Use flow metadata to see who connected to whom and when without assuming access to packet contents.
Support for NetFlow
Collect flow metadata to see which systems communicated and when without assuming visibility into packet contents.
Support for IPFIX
Collect flow metadata to see which systems communicated and when without assuming visibility into packet contents.
Support for sFlow
Collect flow metadata to see which systems communicated and when without assuming visibility into packet contents.
Support for allocated fields within flows
Inspect a sample in the supported scope and compare the signals with both normal and unusual activity.
Remove repetitive flows from several sources
Reduce disruption from a component failure; test actual failover and recovery to normal operation.
Recording and analysis of raw data
Inspect a sample in the supported scope and compare the signals with both normal and unusual activity.
Storage and analysis of large amounts of network data
Inspect a sample in the supported scope and compare the signals with both normal and unusual activity.
Analysis of transactions within flows
Inspect a sample in the supported scope and compare the signals with both normal and unusual activity.
Operational trends and metrics
Use flow data to derive traffic trends and performance metrics, then compare current activity with expected network behavior.
Observation and Vision
Monitoring of networks
Show activity within the covered scope and associate events with an asset or session during review.
Monitoring of applications and their uses
Show activity within the covered scope and associate events with an asset or session during review.
Surveillance of servers, hosts and subnetworks
Show activity within the covered scope and associate events with an asset or session during review.
Customized monitoring panels.
Present reviewable results to compare changes and identify cases requiring action.
Operational and Security Alerts
Notify the team when a monitoring rule is met; set the threshold and escalation path.
Context Analysis of Network Parameters
Inspect a sample in the supported scope and compare the signals with both normal and unusual activity.
Unified search within data
Narrow results by operational criteria so teams find the needed record without exposing unrelated data.
Detailed transition to ports, interfaces and network addresses
Track address assignment and its source and associate changes with the affected segment and device.
Direct interaction with data and paintings
Present reviewable results to compare changes and identify cases requiring action.
Performance monitoring
Monitoring layers from L4 to L7
Show activity within the covered scope and associate events with an asset or session during review.
Analysis of the TCP Protocol
Review signals such as retransmissions and connection errors where available to explain performance degradation.
The Seventh Class Applications
Show activity within the covered scope and associate events with an asset or session during review.
Measurement of Applications response time
Compare response time on covered paths with a baseline to distinguish congestion from an application issue.
DNS and HTTP Services
Manage the configuration through domain records and verify published values and propagation before rollout.
Detection of disruptions and performance problems
Measure behavior under expected load and during a component interruption or recovery.
Analysis of communication errors
Inspect a sample in the supported scope and compare the signals with both normal and unusual activity.
Security and threat detection
Detect threats and anomalies in network behavior
Compare flows with normal behavior and add asset context before treating an anomaly as an incident.
Network investigations
It provides research and analysis capabilities that help track accidents and analyze activities within the network.
Threat hunting
Test the scenario that triggers protection and a similar legitimate case to tune false positives.
Continuous analysis of security data
Inspect a sample in the supported scope and compare the signals with both normal and unusual activity.
Discover unusual activities.
Helps in monitoring unusual activities and unwanted communications related to systems and servers within the network.
Detection rules mapped to MITRE ATT&CK
Turn organizational requirements into testable settings and define who may approve exceptions.
Monitoring Panels for Security Operations teams
Present reviewable results to compare changes and identify cases requiring action.
Analyze security risk trends
Inspect a sample in the supported scope and compare the signals with both normal and unusual activity.
Asset discovery and dependency mapping
Discovering assets in real time.
Surface in-scope assets and attributes so teams can distinguish known assets from those needing review.
Following the network stock.
Surface in-scope assets and attributes so teams can distinguish known assets from those needing review.
Map dependencies between servers and clients
Map service dependencies using flows without inferring trust simply because two systems communicate.
Analysis of subnetwork relationships
Inspect a sample in the supported scope and compare the signals with both normal and unusual activity.
Identifying unwanted movements
Surface in-scope assets and attributes so teams can distinguish known assets from those needing review.
Detection of policy breaches
Turn organizational requirements into testable settings and define who may approve exceptions.
Integration and Management
Integration of external applications
Identify both integration endpoints and the data they exchange; verify behavior if either endpoint is unavailable.
Integration of warnings with other systems
Notify the team when a monitoring rule is met; set the threshold and escalation path.
Exchange of data with different systems
Identify both integration endpoints and the data they exchange; verify behavior if either endpoint is unavailable.
Enriching data
Identify both integration endpoints and the data they exchange; verify behavior if either endpoint is unavailable.
Operating mechanical procedures in external systems
Run repetitive steps under defined conditions and review failures and exceptions.
Management of multiple sites
Identify both integration endpoints and the data they exchange; verify behavior if either endpoint is unavailable.
Multi-leader management
Identify both integration endpoints and the data they exchange; verify behavior if either endpoint is unavailable.
Operations and reliability
Data collection of high performance.
Measure behavior under expected load and during a component interruption or recovery.
Flexible processing engine.
Confirm environment requirements, supported versions, and dependencies before moving the configuration to production.
Supporting multiple flow protocols
Confirm environment requirements, supported versions, and dependencies before moving the configuration to production.
Remove the integrated repetition.
Reduce disruption from a component failure; test actual failover and recovery to normal operation.
Analytical content is ready.
Inspect a sample in the supported scope and compare the signals with both normal and unusual activity.
Prepared scenarios for operating and security teams
Identify a supported operating or managed platform; verify version, enrollment, and available policies.
Discovering new fields within flow
Confirm environment requirements, supported versions, and dependencies before moving the configuration to production.
Preserving accuracy when data patterns change
Confirm environment requirements, supported versions, and dependencies before moving the configuration to production.
How the technology works
Data collection and analysis
The technology collects and continuously analyses flow data from multiple sources to extract operational and security indicators.
Remove the repetition.
It removes repeated flows coming from several sources to improve the analysis accuracy and reduce noise within data.
Monitoring and Analysis
It provides continuous monitoring of network, applications, servers and services with the possibility of deepening in operating details.
Discover threats.
They rely on security rules and behavior analysis and deviations to detect unusual activities and security threats.
Network investigations
Search and analysis tools help trace incidents and investigate activity across the network.
Performance monitoring
It helps to measure response time, analyze communication errors, and detects interruptions and performance problems.
Discovering the assets.
It discovers the devices and servers and analyses the relationships and reliances between them.
Integration
It provides integrated interfaces that allow you to exchange data and connect alerts with other systems.
What to validate before rollout
- Choose monitoring points based on critical traffic paths.
- Review connection patterns and changes from normal activity.
- Correlate findings with other logs and assign ownership of containment decisions.
Integration and scope
Identify telemetry sources, visibility points, and what remains observable under encryption. Distinguish alerts from response actions available through integrations.
Challenges this solution addresses
- Weak vision within the networks.
- Difficulty Analysis of Network Movement
- Slow detection of disorders.
- Disadvantaged application performance monitoring
- Difficulty in detecting dishes.
- Discovery of threats.
- The security investigations are delayed.
- Weak asset control.
- Difficulty in understanding the confidentiality between systems
- Disadvantage of service and communication
- Difficulty in detecting unusual activities.
- Disadvantaged safety risk monitoring
- Difficulty in managing and analysing big data
- The integration of monitoring systems.
- Slow response to incidents.
Regulatory alignment
Illustrative ways to support control implementation. An area may have more than one example; each row is not necessarily a separate official control.
NCA · ECC 2:2024For entities within the scope of the Essential Cybersecurity Controls.
| Domain or control | How it supports implementation | Application |
|---|---|---|
| Management of assets | Providing a vision of the assets and their activity within the network and analyzing the reliability between them Related capability: Asset discovery and dependency analysis | Applied |
| Network Security Management | Monitoring of network and services traffic, communication and interruption analysis Related capability: Analysis and monitoring of networks | Applied |
| Management of records and monitoring | Collect and analyze events, warnings and monitoring activities Related capability: Advertisements, monitoring tables and analysis | Applied |
| Incident and threat management | Detection of threats, incident analysis and network investigation Related capability: Threats and Network Investigations | Applied |
| Management of deficiencies | Support understanding and analysis of network activities and risks Related capability: Movement analysis and discovery of unusual activities | Applied |
| Continuity of business | Reduce the diagnosis time and improves the analysis and response speed. Test failure and recovery paths. This capability does not replace a complete continuity or recovery plan. Related capability: Performance monitoring and problem analysis | Applied |
| review and audit | Provide operating and security panels, reports and indicators Related capability: Reports and tracking tables | Applied |
| Cyber Security for Technical Projects | Performance and safety monitoring after technical and operational changes Related capability: Basic Line and Operational Analysis | Applied |
| Security of external parties | Supporting integration with external systems and data exchange Related capability: Integration and automatic operation | Applied |
SAMA · CSFFor financial institutions within the Saudi Central Bank framework, subject to the control's applicability.
| Domain or control | How it supports implementation | Application |
|---|---|---|
| Management of assets | The technology supports the formation of a centralized visibility of network assets, track their activity, and analyzes reliability between servers, customers and subnetworks. Related capability: Asset discovery and dependency analysis | Applied |
| Management of Networks | Provide monitoring of network traffic, communication analysis, detection of interruptions, and tracking services and protocols supported within flow Related capability: Analysis and Network Monitoring | Applied |
| Security Monitoring | Supports network activity analysis, detection of deviations, and security indicators monitoring through panels and warnings Related capability: Security Analysis and Warnings | Applied |
| Events and records. | Provide continuous collection and analysis of network data, warnings, movement-related events and unusual activities Related capability: Monitoring Panels, Alerts and Analysis | Applied |
| Incident response | Support network investigations and incident analysis through research, data deepening, and linking activities to ports, interfaces, and addresses Related capability: Network research and detailed analysis | Applied |
| Risk Management | Helps in understanding network risk indicators by analyzing trends, detecting unusual activities, and monitoring performance and risk indicators Settings or logs can help prepare evidence. Governance decisions and effectiveness testing remain with the organization. Related capability: Trends and risk indicators analysis | Applied |
| Protection of Infrastructure | Supports monitoring of network components, servers and services and analysis of communication traffic to help detect failures and unwanted activities Related capability: Monitoring of servers, networks and services | Applied |
| Operational Security | Support operating and security teams through ready-made scenarios, tracking tables, warnings, and analyses that help track the operating and security situation Related capability: Scenarios of Operations teams and tracking tables | Applied |
| Protecting the systems | Helps in monitoring unusual activities and unwanted communications related to systems and servers within the network Related capability: Detection of abnormal activities and analysis of movement | Applied |
| compliance and audit | Provide panels, indicators, reports and analytical records that can be used in periodic audit and security and operational status verification Settings or logs can help prepare evidence. Governance decisions and effectiveness testing remain with the organization. Related capability: Report and Indicator Panels | Applied |
| Continuity of business | It helps to reduce the time of diagnosis of disorders and interruptions, and improves the analysis speed when problems affect the availability of services Test failure and recovery paths. This capability does not replace a complete continuity or recovery plan. Related capability: Performance Monitoring and Analysis | Applied |
| Protection of sensitive financial systems | Support the monitoring of sensitive systems-related networks, services and communications by analyzing flow, warnings and network investigations Related capability: Analysis of flow and security alerts | Applied |
NCA · OTCC-1:2022For operational technology and industrial control environments to which the controls apply.
Evaluate these examples against the facility level and assets in scope. They do not authorize IT/OT connectivity or component installation on operational assets without assessment.
| Domain or control | How it supports implementation | Application |
|---|---|---|
| Visibility and monitoring | Provide a comprehensive vision of network, services and applications Related capability: Monitoring and Analysis | Applied |
| Monitoring of assets | Tracking assets and analysis of relationships and reliances between them Related capability: Asset discovery and dependency analysis | Applied |
| Discover threats. | Detection of abnormal activities and security risks analysis Related capability: Security analytics and threat hunting | Applied |
| Incident response | Support investigations and security incidents analysis Verify asset compatibility and test operational impact before deploying an agent or taking response action in an OT environment. Related capability: Network investigations and security analysis | Applied |
| Management of communication between environments | Analysis and monitoring of network communication Use only authorized paths and assets. Network isolation and remote-access approval requirements still apply. Related capability: Analysis of flow and movement analysis | Applied |
| Isolation of networks. | Detection of unwanted communications and policy breaches Use only authorized paths and assets. Network isolation and remote-access approval requirements still apply. Related capability: Movement Analysis and Communication Monitoring | Applied |
| Protection of operating environments | Monitoring of networks and communications within operating environments Related capability: Monitoring and communication analysis | Applied |
| Change and Discover Changes | Discover new fields and flow within the network Related capability: Discover new fields and analyze flows | Applied |
| Continuous monitoring | Continuous analysis of data and detection of threats and problems Related capability: Continuous analysis and warnings | Applied |
“Applied” describes the capability in the illustrative example, not an implementation or compliance status for the customer.
Decision questions
Questions before you start
How do we know this solution is right for us?
Start with the risk signals on this page. If they match your environment, they can be turned into a short assessment that defines scope, priority, and a practical implementation approach.
How do we start without adding operational complexity?
Start with a focused risk and scope assessment, then define implementation priorities, technical requirements, and phased rollout steps.
Related solutions
NAC
Network Access Control
Verify devices and users before allowing them to connect to the network.
Explore solutionEDR
Endpoint Detection and Response
Detect threat behavior on endpoints and support containment and investigation.
Explore solutionDeception
Deception Threat Detection
Use decoy assets and lures to detect attackers inside the environment early.
Explore solutionSIEM Advisory
Security Monitoring and SIEM Advisory
Design log sources, detection use cases, and investigation workflows before or during SIEM adoption.
Explore solutionReady for the next step?
Turn this need into a practical assessment and clear implementation plan.
Share your use case and priority systems so we can discuss a pilot and its integration requirements.