NDR

What is NDR?

Network Detection and Response (NDR) is a cybersecurity technology that continuously and passively analyses network traffic to detect attacks, lateral movement, protocol abuse and other anomalies, and that helps analysts investigate and respond to them. NDR combines protocol decoding, behavioural analysis, machine learning and threat intelligence, so it sees activity that firewalls and endpoint protection miss. Gartner gave the market this name in 2020; before that, the same category was called network traffic analysis (NTA). In industrial environments NDR is often the only practical way to gain visibility into ICS and OT networks, because PLCs and HMIs rarely support an agent or meaningful logging. With the rise of the IIoT, Industry 4.0 and cloud connections, the number of paths into OT keeps growing, and so does the value of that visibility.

🧠 What does NDR detect?

NDR does not focus on availability or performance, as classic network monitoring does, but on security behaviour in network communication. Typical detections are:

• Lateral movement - a compromised system reaching other systems via RDP, SMB, SSH or WMI
• Command and control - periodic outbound traffic (beaconing) to unknown destinations
• Protocol abuse - unexpected write commands, program downloads or stop commands sent to a PLC
• New or unknown devices - a laptop or engineering workstation suddenly appearing in an OT zone
• Scanning and reconnaissance - port scans or discovery traffic inside production networks
• Data exfiltration - unusually large outbound data flows
• Insider threats and privilege misuse - legitimate accounts acting outside their normal pattern

It is precisely these behaviour-based detections that make NDR strong against living-off-the-land attacks such as those by Volt Typhoon: there is little malware to find, but the network paths and timing still differ from the normal picture.

⚙️ How does an NDR platform work?

An NDR platform receives a copy of network traffic and sends nothing into the production network itself. The common sources are:

The analysis then follows fixed steps: collection, protocol decoding with DPI, building a behavioural baseline, detecting deviations with rules, signatures and anomaly detection, enrichment with threat intelligence, and finally investigation and response. Open-source building blocks such as Zeek and Suricata underpin many platforms; for industrial protocols there are the ICSNPP parsers for Zeek, developed by Idaho National Laboratory and published through the GitHub organisation of CISA.

🔄 What is the difference between NDR, IDS, IPS, EDR and SIEM?

An IDS mainly compares traffic against known signatures, and an IPS also blocks inline. NDR adds behavioural analysis, metadata history and investigation capabilities. Together with SIEM and EDR, NDR forms the so-called SOC visibility triad: logs, endpoints and network.

XDR combines several of these sources in a single platform, with NDR providing the network component.

🏭 How does NDR work in OT environments?

OT networks are deterministic, use legacy protocols without authentication and must not be disrupted. NDR in OT is therefore almost always passive monitoring. OT-specific NDR platforms, for example from Nozomi, Claroty and Dragos, decode industrial protocols down to the level of commands and variables:

Most platforms also support ProfiNET. A firewall only sees that there is traffic on port 502 (unless it is an industrial firewall with Modbus inspection); NDR also sees which register is written, by which system, and whether that has ever happened before.

A second important function is passive asset inventory: from the traffic, NDR derives the make, model, firmware version and communication relationships of devices. For many companies, this is the first complete overview of their assets.

🔍 How does baselining work in practice?

Industrial communication is predictable, so behavioural baselines work better in OT than in office networks. A baseline records which systems talk to each other, over which protocols and function codes, with which volumes and at which times. A PLC normally talks to its SCADA server, the HMI, a fixed engineering workstation and sometimes a historian or another PLC, and to nobody else.

Typical deviations that stand out:

• Program download from an unknown system - technique T0843 Program Download in MITRE ATT&CK for ICS; MITRE advises alerting when the source is not on the list of approved engineering workstations
• Write commands outside a maintenance window - the pattern of FrostyGoop, which used Modbus TCP in January 2024 to shut down heating to around 600 apartment buildings in Lviv
• An HMI making DNS requests to the internet - almost always suspicious
• Traffic that skips zones - an office workstation talking directly to a PLC, contrary to the Purdue Model

Analysts use the same metadata for threat hunting: actively searching for traces that never raised an alarm. Machine learning and other AI techniques help with clustering and prioritisation, but also produce false positives. Maintenance, firmware updates and vendor maintenance look like attacks to an algorithm, so a link to change management and human review remain necessary.

🧭 How do you implement NDR in an OT network?

1. Choose the measurement points - start at the boundaries between IT and OT and between zones; one TAP or SPAN port per zone on the core switch is often a good start
2. Use passive sensors - no inline equipment in the control network; check that the sensor decodes every protocol you use
3. Let the baseline learn - allow several weeks and include at least one full production cycle, including planned stops
4. Validate with the process people - let operators and engineers decide which deviations are legitimate before alerts go to the SOC
5. Connect to SIEM and SOC - send alerts to the SIEM and an OT SOC, with clear agreements on who may intervene in OT
6. Rehearse the response - automatic blocking in OT can stop a process; record in the incident response plan which actions remain manual

🔐 Which standards and laws call for network detection?

Without detection, an organisation can hardly meet the reporting deadlines of the Dutch Cybersecurity Act: you have to notice an incident before the clock starts. NDR also fits within Defense in Depth and Zero Trust: segmentation and microsegmentation restrict traffic, and NDR checks that the rules are actually followed in practice. Within IEC 62443 and OT convergence, NDR thus provides evidence that zones and conduits work.

❓ Frequently asked questions

What does NDR stand for?

NDR stands for Network Detection and Response. It is a category of security tools that analyses network traffic to detect attacks and anomalies and to support investigation and response. Until 2020, Gartner called the same market network traffic analysis (NTA).

Is NDR safe for PLCs and other OT equipment?

Yes, provided NDR is deployed passively through a TAP or SPAN port. The sensor only listens and sends no traffic to PLCs or HMIs, so the process is not affected. Some platforms offer optional active queries to devices; in OT you enable those only deliberately and in a controlled way.

Can NDR analyse encrypted traffic?

NDR cannot read the content of encrypted traffic, such as TLS or encrypted OPC UA, without decryption. Metadata remains useful, however: who talks to whom, certificates, packet sizes, timing and volumes. Most OT traffic is still unencrypted, which is exactly why NDR gives so much insight there.

Do I still need a SIEM and EDR alongside NDR?

Yes, NDR does not replace a SIEM or EDR but complements them. EDR sees processes on endpoints, a SIEM correlates logs, and NDR sees the network, including devices that cannot run an agent. Together they form the three sources a SOC bases its detection on.

How long does it take to learn an NDR baseline?

An NDR baseline in OT typically needs several weeks of learning time. The learning period should include at least one full production cycle and normal maintenance activities. Operators should then review the baseline, because suspicious traffic that was already present would otherwise be learned as normal.

What is the difference between NDR and an IDS?

An IDS mainly compares network traffic with signatures of known attacks and produces individual alerts. NDR combines signatures with behavioural analysis and stores metadata or packets, so analysts can also find unknown attacks and reconstruct an incident afterwards. In OT, the term IDS is still often used for what is in fact an NDR platform.

📌 In summary

NDR passively analyses network traffic to detect attacks, lateral movement and protocol abuse, and in OT it is often the only way to gain visibility into PLCs and other devices that cannot run an agent. With protocol decoding down to function-code level, behavioural baselines and integration with SIEM and SOC, NDR supports the monitoring requirements of IEC 62443, NIST and the Dutch Cybersecurity Act.