# What is Network Detection and Response (NDR)?

> Network detection and response (NDR) is a security capability that analyzes network communications to identify suspicious behavior, support investigation, and trigger or guide response.

- Canonical URL: https://yellowcube.eu/glossary/network-detection-and-response/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

It commonly uses packet data, flow records, protocol metadata, traffic patterns, or a combination of these sources.

NDR can reveal activity across systems that do not support endpoint agents, making it useful in data centers, cloud networks, and operational technology environments. It can also help analysts follow lateral movement or command-and-control traffic, provided sensors are positioned where the relevant communications are visible.

Its limits are structural: pervasive encryption hides payload content and forces reliance on metadata, timing, and destination reputation; cloud and software-defined networking can move traffic past fixed sensors; and behavioral baselines need time to learn what “normal” means in each environment — and will flag the unusual-but-legitimate alongside the malicious.

### Key points

- **Primary purpose:** Detect and investigate malicious or anomalous activity from network evidence.
- **Typical methods:** Protocol analysis, behavioral baselining, signatures, threat-intelligence matching, and traffic correlation.
- **Design dependency:** Sensor placement, network topology, east–west visibility, time synchronization, and retained evidence materially affect results.
- **Important limitation:** Encryption, asymmetric routing, cloud architecture, high traffic volume, and activity confined to a host can reduce visibility.

### Related terms

[Endpoint detection and response (EDR)](<https://yellowcube.eu/glossary/endpoint-detection-and-response/>) · [Extended detection and response (XDR)](<https://yellowcube.eu/glossary/extended-detection-and-response/>) · [Network segmentation](<https://yellowcube.eu/glossary/network-segmentation/>) · [Security information and event management (SIEM)](<https://yellowcube.eu/glossary/security-information-and-event-management/>) · [Cyber threat intelligence (CTI)](<https://yellowcube.eu/glossary/cyber-threat-intelligence/>)

### Sources

[NIST SP 800-94: Guide to Intrusion Detection and Prevention Systems](https://csrc.nist.gov/pubs/sp/800/94/final) · [NIST SP 800-82r3: Guide to Operational Technology Security](https://csrc.nist.gov/pubs/sp/800/82/r3/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.