Network Detection and Response (NDR)
Identify and mitigate threats in real-time.
CyberGuard
What is Network Detection and Response?
Network Detection and Response (NDR) platforms capture network metadata, enriches it with machine learning derived security intelligence, and applies it to your detection and response use-cases.
One of the key benefits of NDR is its ability to provide proactive threat detection. By continuously analysing network traffic and behaviour, Wavenet CyberGuard’s NDR solutions can identify suspicious activities such as malware infections, data exfiltration attempts, and unauthorised access. This early detection enables security teams to respond quickly and prevent potential breaches or damage.
Respond to potential security incidents swiftly
Detect
-
Scores of custom-built attacker behaviour models detect threats automatically and in real-time before they do damage.
-
Detected threats are automatically triaged, prioritised based on risk level, and correlated with compromised host devices.
-
Tier 1 automation condenses weeks or months of work into minutes and reduces the security analyst workload by 37X.
Respond
-
Machine learning-derived attributes like host identify and beaconing provide vital context that reveals the broader scale and scope of an attack.
-
Custom-engineered investigative workbench is optimised for security-enriched metadata and enables sub-second searches at scale.
-
Puts the most relevant information at your fingertips. Augmenting detection with actionable context eliminates the endless hunt and search for threats.
Capture Data
Sensors are deployed across cloud, data centre and enterprise environments, where they extract relevant metadata from traffic and ingest external threat intelligence and Active Directory and DHCP logs. A uniquely efficient software architecture developed from Day 1, along with custom-developed processing engines, enable data capture and processing with unprecedented scale.
Normalise Data
Traffic flows are deduplicated and a custom flow engine extracts metadata to detect attacker behaviours. The characteristics of every flow are recorded, including the ebb and flow, timing, traffic direction, and size of packets. Each flow is then attributed to a host rather than being identified by an IP address.
Enrich Data
Data scientists and security researchers build and continually tune scores of self-learning behavioural models that enrich the metadata with machine learning-derived security information.
