OpenText Network Detection and Response

Network Detection and Response is the network-layer SOC product inside the OpenText SecOps line. It analyzes east-west traffic (server-to-server inside the network), runs behavioral detection on traffic patterns, and captures packets for forensic-grade investigation. Where EDR sees what happens on the endpoint and SIEM sees what was logged, NDR sees what crossed the wire. Programs running EDR plus SIEM without NDR have a visibility gap that lateral-movement attacks exploit.

Behavioral detection is the load-bearing capability. Signature-only NDR is detection theater on modern threats; lateral movement, beaconing, and data exfiltration patterns rarely match a static signature. Behavioral detection looks at traffic shape (volume, periodicity, destination patterns, protocol anomalies, encrypted-traffic-pattern analysis) and flags deviations from baseline. Programs running NDR without behavioral detection miss the patterns NDR exists to catch.

Packet capture for forensics is the depth advantage. When the SOC investigates an incident, the question is usually what was actually transferred. Behavioral detection and flow data show patterns; packet capture shows content. Programs subject to regulated breach investigations or operating in environments where adversary attribution matters need packet-level forensic data, and NDR without packet capture is a partial answer.

What undermines NDR adoption is sensor placement. The product needs network telemetry from the right places (north-south at the perimeter, east-west between segments, internal-to-internal across critical infrastructure) and programs that deploy sensors only at the perimeter miss the lateral-movement attacks NDR is supposed to catch. Merito's engagement maps the network for sensor placement before deploying anything, and validates the coverage against the lateral-movement scenarios the SOC is responsible for catching.

Merito has audited SOCs running rigorous EDR (CrowdStrike, SentinelOne) and SIEM (Splunk, Sentinel) and missing every lateral-movement attack because nothing was watching east-west traffic. EDR shows what happened on the endpoint; SIEM shows what was logged; NDR shows what crossed the wire. Programs running EDR plus SIEM without NDR have a visibility gap that modern attackers exploit.

Merito recommends OpenText NDR specifically for programs already running OpenText Cybersecurity or modernizing onto Core Threat Detection and Response, when network-layer visibility is the gap, and when packet capture for forensic investigation matters. For programs picking specialist NDR breadth, ExtraHop, Vectra, or Darktrace are competitive depending on the program shape. Merito surfaces those alternatives honestly.

Sensor placement is the operational point of failure. Programs that deploy sensors only at the perimeter (north-south) and skip east-west see only what crosses the boundary, which is the easy half. Lateral-movement attacks live east-west and need east-west visibility. Merito treats sensor-placement design as central work in the implementation rather than a checkbox.