Network Detection and Response is OpenText's network-layer product for the SOC. It analyzes east-west traffic (server-to-server inside the network), runs behavioral detection on traffic patterns, and captures packets for forensic-grade investigation. Where EDR sees what happens on the endpoint and SIEM sees what was logged, NDR sees what crossed the wire. Programs running EDR plus SIEM without NDR have a visibility gap that lateral-movement attacks exploit.
Behavioral detection is the load-bearing capability. Signature-only NDR is detection theater on modern threats; lateral movement, beaconing, and data exfiltration patterns rarely match a static signature. Behavioral detection looks at traffic shape (volume, periodicity, destination patterns, protocol anomalies, encrypted-traffic-pattern analysis) and flags deviations from baseline. Programs running NDR without behavioral detection miss the patterns NDR exists to catch.
Packet capture for forensics is the depth advantage. When the SOC investigates an incident, the question is usually what was actually transferred. Behavioral detection and flow data show patterns; packet capture shows content. Programs subject to regulated breach investigations or operating in environments where adversary attribution matters need packet-level forensic data, and NDR without packet capture is a partial answer.
Sensor placement decides whether NDR catches anything. The product needs network telemetry from the right places (north-south at the perimeter, east-west between segments, internal-to-internal across critical infrastructure) and programs that deploy sensors only at the perimeter miss the lateral-movement attacks NDR is supposed to catch. Merito's engagement maps the network for sensor placement before deploying anything, and validates the coverage against the lateral-movement scenarios the SOC is responsible for catching.
Ideal use cases
- East-west traffic visibility complementing EDR and SIEM
- Behavioral detection of lateral movement, beaconing, and data exfiltration
- Packet capture for forensic-grade investigation
- NDR alerts investigated alongside SIEM detections in Threat Detection and Response
- Regulated network detection evidence for SOC 2, HIPAA, and PCI DSS